Details
-
Type:
Bug
-
Status:
Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: 1.9.6, 2.0
-
Fix Version/s: 2.0.8, STABLE backlog
-
Component/s: HTML Editor, Language
-
Labels:None
-
Affected Branches:MOODLE_19_STABLE, MOODLE_20_STABLE
-
Fixed Branches:MOODLE_20_STABLE
Description
I am sure that the strings are all correctly escaped in the language files, and also the language editor correctly escapes when you save ,, but I just had a problem with a site that was sending "OK"-button to Javascript, and it was breaking the editor.
Since we do support local translations, and don't enforce the editor, I believe we should put some smarts into the htmlarea.php to do something like addslashes(stripslashes($string)) before sending it to JS.
addslashes is a nono for javascript, we have addslashes_js() for that, I am not sure here, but in this case we might have to use s() or htmlentities() too