Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Minor
-
Resolution: Duplicate
-
Affects Version/s: 1.8.2
-
Fix Version/s: None
-
Component/s: SCORM
-
Labels:None
-
Environment:Windows Professional XP using IE or Firefox browsers
-
Database:MySQL
-
Affected Branches:MOODLE_18_STABLE
Description
When we ran our SCORM course using Moodle, we found that the file "api.php" does this with the value we submit:
eval(element+'="'value'";');
This means that it is not escaping single quotes which results in an invalid snippet being sent to "eval"
