### Eclipse Workspace Patch 1.0
#P moodle_18
Index: blocks/course_list/block_course_list.php
===================================================================
RCS file: /cvsroot/moodle/moodle/blocks/course_list/block_course_list.php,v
retrieving revision 1.40.2.3
diff -u -r1.40.2.3 block_course_list.php
--- blocks/course_list/block_course_list.php	26 Feb 2007 08:51:22 -0000	1.40.2.3
+++ blocks/course_list/block_course_list.php	27 Feb 2007 22:49:17 -0000
@@ -44,8 +44,8 @@
                         continue;
                     }
                     $linkcss = $course->visible ? "" : " class=\"dimmed\" ";
-                    $this->content->items[]="<a $linkcss title=\"" . s($course->shortname) . "\" ".
-                               "href=\"$CFG->wwwroot/course/view.php?id=$course->id\">" . s($course->fullname) . "</a>";
+                    $this->content->items[]="<a $linkcss title=\"" . format_string($course->shortname) . "\" ".
+                               "href=\"$CFG->wwwroot/course/view.php?id=$course->id\">" . format_string($course->fullname) . "</a>";
                     $this->content->icons[]=$icon;
                 }
                 $this->title = get_string('mycourses');
@@ -65,7 +65,7 @@
             if (count($categories) > 1 || (count($categories) == 1 && count_records('course') > 200)) {     // Just print top level category links
                 foreach ($categories as $category) {
                     $linkcss = $category->visible ? "" : " class=\"dimmed\" ";
-                    $this->content->items[]="<a $linkcss href=\"$CFG->wwwroot/course/category.php?id=$category->id\">" . s($category->name) . "</a>";
+                    $this->content->items[]="<a $linkcss href=\"$CFG->wwwroot/course/category.php?id=$category->id\">" . format_string($category->name) . "</a>";
                     $this->content->icons[]=$icon;
                 }
                 $this->content->icons[] = '';
@@ -83,14 +83,18 @@
                 if ($courses) {
                     foreach ($courses as $course) {
                         $linkcss = $course->visible ? "" : " class=\"dimmed\" ";
-                        $this->content->items[]="<a $linkcss title=\"".s($course->shortname)."\" ".
-                                   "href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->fullname</a>";
+
+                        $this->content->items[]="<a $linkcss title=\""
+                                   . format_string($course->shortname)."\" ".
+                                   "href=\"$CFG->wwwroot/course/view.php?id=$course->id\">" 
+                                   . $course->fullname . "</a>";
                         $this->content->icons[]=$icon;
                     }
                 /// If we can update any course of the view all isn't hidden, show the view all courses link
                     if (has_capability('moodle/course:update', get_context_instance(CONTEXT_SYSTEM)) || empty($CFG->block_course_list_hideallcourseslink)) {
                         $this->content->icons[] = '';
-                        $this->content->items[] = "&nbsp;&nbsp;&nbsp;<a href=\"$CFG->wwwroot/course/index.php\">".get_string("fulllistofcourses")."</a>...";
+                        $this->content->items[] = "&nbsp;&nbsp;&nbsp;<a href=\"$CFG->wwwroot/course/index.php\">"
+                            .get_string("fulllistofcourses")."</a>...";
                     }
                     $this->get_remote_courses();
                 } else {
@@ -123,8 +127,9 @@
             $this->content->items[] = get_string('remotecourses','mnet');
             $this->content->icons[] = '';
             foreach ($courses as $course) {
-                $this->content->items[]="<a title=\"$course->shortname\" ".
-                    "href=\"{$CFG->wwwroot}/auth/mnet/jump.php?hostid={$course->hostid}&amp;wantsurl=/course/view.php?id={$course->remoteid}\">$course->fullname</a>";
+                $this->content->items[]="<a title=\"" . format_string($course->shortname) . "\" ".
+                    "href=\"{$CFG->wwwroot}/auth/mnet/jump.php?hostid={$course->hostid}&amp;wantsurl=/course/view.php?id={$course->remoteid}\">" 
+                    . format_string($course->fullname) . "</a>";
                 $this->content->icons[]=$icon;
             }
             // if we listed courses, we are done
Index: course/index.php
===================================================================
RCS file: /cvsroot/moodle/moodle/course/index.php,v
retrieving revision 1.67.2.1
diff -u -r1.67.2.1 index.php
--- course/index.php	23 Feb 2007 05:05:57 -0000	1.67.2.1
+++ course/index.php	27 Feb 2007 22:49:17 -0000
@@ -106,9 +106,9 @@
             $newcategory->name = $form->addcategory;
             $newcategory->sortorder = 999;
             if (!insert_record('course_categories', $newcategory)) {
-                notify("Could not insert the new category '" . s($newcategory->name) . "'");
+                notify("Could not insert the new category '" . format_string($newcategory->name) . "'");
             } else {
-                notify(get_string('categoryadded', '', s($newcategory->name)));
+                notify(get_string('categoryadded', '', format_string($newcategory->name)));
             }
         }
     }
@@ -145,11 +145,11 @@
                 
                 /// Finally delete the category itself
                 if (delete_records('course_categories', 'id', $deletecat->id)) {
-                    notify(get_string('categorydeleted', '', s($deletecat->name)));
+                    notify(get_string('categorydeleted', '', format_string($deletecat->name)));
                 }
             }
             else {
-                $strdeletecategorycheck = get_string('deletecategorycheck','', s($deletecat->name));
+                $strdeletecategorycheck = get_string('deletecategorycheck','', format_string($deletecat->name));
                 notice_yesno($strdeletecategorycheck,
                              "index.php?delete=$delete&amp;sure=".md5($deletecat->timemodified)."&amp;sesskey=$USER->sesskey",
                              "index.php?sesskey=$USER->sesskey");
@@ -353,7 +353,7 @@
         $linkcss = $category->visible ? '' : ' class="dimmed" ';
         echo '<a '.$linkcss.' title="'.$str->edit.'" '.
              ' href="category.php?id='.$category->id.'&amp;categoryedit=on&amp;sesskey='.sesskey().'">'.
-             s($category->name).'</a>';
+             format_string($category->name).'</a>';
         echo '</td>';
 
         echo '<td class="count">'.$category->coursecount.'</td>';
Index: course/lib.php
===================================================================
RCS file: /cvsroot/moodle/moodle/course/lib.php,v
retrieving revision 1.484.2.4
diff -u -r1.484.2.4 lib.php
--- course/lib.php	26 Feb 2007 02:33:41 -0000	1.484.2.4
+++ course/lib.php	27 Feb 2007 22:49:18 -0000
@@ -1557,9 +1557,9 @@
 
     if ($category) {
         if ($path) {
-            $path = $path.' / '.s($category->name);
+            $path = $path.' / '.format_string($category->name);
         } else {
-            $path = s($category->name);
+            $path = format_string($category->name);
         }
         $list[$category->id] = $path;
     } else {
@@ -1791,7 +1791,7 @@
     echo '<div class="info">';
     echo '<div class="name"><a title="'.get_string('entercourse').'"'.
          $linkcss.' href="'.$CFG->wwwroot.'/course/view.php?id='.$course->id.'">'.
-         $course->fullname.'</a></div>';   
+         format_string($course->fullname).'</a></div>';   
     
     /// first find all roles that are supposed to be displayed
     if ($managerroles = get_config('', 'coursemanager')) {
Index: course/category.php
===================================================================
RCS file: /cvsroot/moodle/moodle/course/category.php,v
retrieving revision 1.93.2.1
diff -u -r1.93.2.1 category.php
--- course/category.php	16 Feb 2007 08:43:13 -0000	1.93.2.1
+++ course/category.php	27 Feb 2007 22:49:17 -0000
@@ -225,7 +225,7 @@
                 }
                 $catlinkcss = $subcategory->visible ? "" : " class=\"dimmed\" ";
                 echo '<a '.$catlinkcss.' href="category.php?id='.$subcategory->id.'">'.
-                     $subcategory->name.'</a><br />';
+                     format_string($subcategory->name).'</a><br />';
             }
         }
         if (!$firstentry) {
@@ -312,7 +312,7 @@
 
             $linkcss = $acourse->visible ? "" : ' class="dimmed" ';
             echo '<tr>';
-            echo '<td><a '.$linkcss.' href="view.php?id='.$acourse->id.'">'.$acourse->fullname.'</a></td>';
+            echo '<td><a '.$linkcss.' href="view.php?id='.$acourse->id.'">'. format_string($acourse->fullname) .'</a></td>';
             if ($creatorediting) {
                 echo "<td>";
                 if (has_capability('moodle/course:update', $coursecontext)) {
Index: lib/weblib.php
===================================================================
RCS file: /cvsroot/moodle/moodle/lib/weblib.php,v
retrieving revision 1.812.2.10
diff -u -r1.812.2.10 weblib.php
--- lib/weblib.php	24 Feb 2007 10:20:35 -0000	1.812.2.10
+++ lib/weblib.php	27 Feb 2007 22:49:18 -0000
@@ -1410,7 +1410,10 @@
 function format_string ($string, $striplinks = false, $courseid=NULL ) {
 
     global $CFG, $COURSE;
-
+    
+    // First replace all ampersands not followed html entity code
+    $string = preg_replace("/\&(?![a-z0-9]{1,8};)/", "&amp;", $string);
+    
     //We'll use a in-memory cache here to speed up repeated strings
     static $strcache = false;
 
@@ -1436,7 +1439,8 @@
 
     //Store to cache
     $strcache[$md5] = $string;
-
+       
+        
     return $string;
 }
 
@@ -2032,7 +2036,9 @@
                        $usexml=false, $bodytags='', $return=false) {
 
     global $USER, $CFG, $THEME, $SESSION, $ME, $SITE, $COURSE;
-
+    
+    $heading = format_string($heading); // Fix for MDL-8582
+    
 /// This makes sure that the header is never repeated twice on a page
     if (defined('HEADER_PRINTED')) {
         debugging('print_header() was called more than once - this should not happen.  Please check the code for this page closely. Note: error() and redirect() are now safe to call after print_header().');
@@ -2222,7 +2228,8 @@
     $bodytags .= ' class="'.$pageclass.'" id="'.$pageid.'"';
 
     ob_start();
-    $title = s($title); // fix for MDL-8582
+
+    $title = format_string($title); // fix for MDL-8582
     include($CFG->header);
     $output = ob_get_contents();
     ob_end_clean();
@@ -2317,10 +2324,10 @@
 
     $shortname ='';
     if ($COURSE->id != SITEID) {
-        $shortname = '<a href="'.$CFG->wwwroot.'/course/view.php?id='. $COURSE->id .'">'. s($COURSE->shortname) .'</a> ->';
+        $shortname = '<a href="'.$CFG->wwwroot.'/course/view.php?id='. $COURSE->id .'">'. format_string($COURSE->shortname) .'</a> ->';
     }
 
-    $output = print_header(s($COURSE->shortname) .': '. s($title), s($COURSE->fullname) .' '. s($heading), $shortname.' '. $navigation, $focus, $meta,
+    $output = print_header(s($COURSE->shortname) .': '. format_string($title), format_string($COURSE->fullname) .' '. format_string($heading), $shortname.' '. $navigation, $focus, $meta,
                            $cache, $button, $menu, $usexml, $bodytags, true);
 
     if ($return) {
@@ -2358,7 +2365,7 @@
             $home  = true;
         } else {
             $homelink = '<div class="homelink"><a '.$CFG->frametarget.' href="'.$CFG->wwwroot.
-                        '/course/view.php?id='.$course->id.'">'.s($course->shortname).'</a></div>';
+                        '/course/view.php?id='.$course->id.'">'.format_string($course->shortname).'</a></div>';
             $home  = false;
         }
     } else {
@@ -2813,16 +2820,47 @@
     }
 
     if ($navigation) {
-        //Accessibility: breadcrumb links now in a list, &raquo; replaced with a 'silent' character.
-        $nav_text = get_string('youarehere','access');
-        $output .= '<h2 class="accesshide">'.$nav_text."</h2><ul>\n";
+        
+        if (!is_array($navigation)) {
+            $ar = explode('->', $navigation);
+            $navigation = array();
+            
+            foreach ($ar as $a) {
+                if (strpos($a, '</a>') === false) {
+                    $navigation[trim(format_string($a))] = '';
+                } else {
+                    if (preg_match('/<a.*href="([^"]*)">(.*)<\/a>/', $a, $matches)) {                  
+                        $navigation[trim(format_string($matches[2]))] = $matches[1];
+                    }
+                }
+            }
+        }
+
         if (! $site = get_site()) {
+            $site = new object();
             $site->shortname = get_string('home');
         }
-
-        $navigation = "<li>$separator ". str_replace('->', "</li>\n<li>$separator", $navigation) ."</li>\n";
-        $output .= '<li class="first"><a '.$CFG->frametarget.' onclick="this.target=\''.$CFG->framename.'\'" href="'. $CFG->wwwroot.((!has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID)) && !empty($USER->id) && !empty($CFG->mymoodleredirect) && !isguest())
-                                                                       ? '/my' : '') .'/">'. $site->shortname ."</a></li>\n". $navigation;
+        
+        //Accessibility: breadcrumb links now in a list, &raquo; replaced with a 'silent' character.
+        $nav_text = get_string('youarehere','access');
+        $output .= '<h2 class="accesshide">'.$nav_text."</h2><ul>\n";
+        
+        $output .= '<li class="first"><a '.$CFG->frametarget.' onclick="this.target=\''.$CFG->framename.'\'" href="'
+               .$CFG->wwwroot.((!has_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM, SITEID))
+                                 && !empty($USER->id) && !empty($CFG->mymoodleredirect) && !isguest())
+                                 ? '/my' : '') .'/">'. format_string($site->shortname) ."</a></li>\n";
+        
+        
+        foreach ($navigation as $title=>$url) {
+            $title = strip_tags(format_string($title));
+            if (empty($url)) {
+                $output .= '<li class="first">'."$separator $title</li>\n";
+            } else {
+                $output .= '<li class="first"><a '.$CFG->frametarget.' onclick="this.target=\''.$CFG->framename.'\'" href="'
+                           .$url.'">'."$separator $title</a></li>\n";
+            }
+        }    
+        
         $output .= "</ul>\n";
     }
 
@@ -5730,4 +5768,4 @@
 }
 
 // vim:autoindent:expandtab:shiftwidth=4:tabstop=4:tw=140:
-?>
\ No newline at end of file
+?>