[LON-CAPA-cvs] cvs: loncom /homework essayresponse.pm /interface loncommon.pm

[kruse]

kruse		Tue Jan 21 14:38:56 2014 EDT

  Modified files:              
    /loncom/interface	loncommon.pm 
    /loncom/homework	essayresponse.pm 
  Log:
  Escaping of student submission when displayed in hand-grading screen
  and in "previous tries" in the excercise itself (Bug #6694).
  
  
Index: loncom/interface/loncommon.pm
diff -u loncom/interface/loncommon.pm:1.1170 loncom/interface/loncommon.pm:1.1171
--- loncom/interface/loncommon.pm:1.1170	Fri Jan  3 18:42:21 2014
+++ loncom/interface/loncommon.pm	Tue Jan 21 14:38:51 2014
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common routines
 #
-# $Id: loncommon.pm,v 1.1170 2014/01/03 18:42:21 raeburn Exp $
+# $Id: loncommon.pm,v 1.1171 2014/01/21 14:38:51 kruse Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -3846,7 +3846,7 @@
                         if (($data eq 'award') || ($data eq 'awarddetail')) {
                             my $value = &format_previous_attempt_value($key,
                                              $returnhash{$version.':'.$key});
-                            $prevattempts.='<td>'.$value.' </td>';
+                            $prevattempts.='<td>'.&HTML::Entities::encode($value, '"<>&').' </td>';
                         } else {
                             $prevattempts.='<td> </td>';
                         }
@@ -3854,7 +3854,7 @@
                         if ($key =~ /\./) {
                             my $value = &format_previous_attempt_value($key,
                                               $returnhash{$version.':'.$key});
-                            $prevattempts.='<td>'.$value.' </td>';
+                            $prevattempts.='<td>'.&HTML::Entities::encode($value, '"<>&').' </td>';
                         } else {
                             $prevattempts.='<td> </td>';
                         }
@@ -3865,7 +3865,7 @@
                     next if ($key =~ /\.foilorder$/);
 		    my $value = &format_previous_attempt_value($key,
 			            $returnhash{$version.':'.$key});
-		    $prevattempts.='<td>'.$value.' </td>';
+		    $prevattempts.='<td>'.&HTML::Entities::encode($value, '"<>&').' </td>';
 	        }
             }
 	    $prevattempts.=&end_data_table_row();
@@ -3890,7 +3890,7 @@
                       if ($key =~/$regexp$/ && (defined &$gradesub)) {
                           $value = &$gradesub($value);
                       }
-                      $prevattempts.='<td>'.$value.' </td>';
+                      $prevattempts.='<td>'. &HTML::Entities::encode($value, '"<>&').' </td>';
                   } else {
                       $prevattempts.='<td> </td>';
                   }
@@ -3899,14 +3899,14 @@
                   if ($key =~/$regexp$/ && (defined &$gradesub)) {
                       $value = &$gradesub($value);
                   }
-                  $prevattempts.='<td>'.$value.' </td>';
+                  $prevattempts.='<td>'.&HTML::Entities::encode($value, '"<>&').' </td>';
               }
           } else {
 	      my $value = &format_previous_attempt_value($key,$lasthash{$key});
 	      if ($key =~/$regexp$/ && (defined &$gradesub)) {
                   $value = &$gradesub($value);
               }
-	      $prevattempts.='<td>'.$value.' </td>';
+	      $prevattempts.='<td>'.&HTML::Entities::encode($value, '"<>&').' </td>';
           }
       }
       $prevattempts.= &end_data_table_row().&end_data_table();
Index: loncom/homework/essayresponse.pm
diff -u loncom/homework/essayresponse.pm:1.117 loncom/homework/essayresponse.pm:1.118
--- loncom/homework/essayresponse.pm:1.117	Tue Dec 18 17:09:45 2012
+++ loncom/homework/essayresponse.pm	Tue Jan 21 14:38:55 2014
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # essay (ungraded) style responses
 #
-# $Id: essayresponse.pm,v 1.117 2012/12/18 17:09:45 raeburn Exp $
+# $Id: essayresponse.pm,v 1.118 2014/01/21 14:38:55 kruse Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -279,7 +279,7 @@
     }
     if ($answer =~ /\S/) {
 	$output.='<p>'.&mt('Submitted text').
-	    '<blockquote>'.$answer.'</blockquote></p>';
+	    '<blockquote>'.&HTML::Entities::encode($answer, '"<>&').'</blockquote></p>';
     }
 
     return '<div class="LC_prior_essay">'.$output.'</div>';