MBS-8802: Fix handling of title strings

mebis-lp · Feb 13, 2024 · c8422c4 · c8422c4
1 parent 9b283d9
commit c8422c4
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 9 deletions.
diff --git a/classes/boardmanager.php b/classes/boardmanager.php
@@ -816,7 +816,7 @@ public function update_card(int $cardid, array $data): void {
         ];
         // Do some extra sanitizing.
         if (isset($data['title'])) {
-            $data['title'] = clean_param($data['title'], PARAM_TEXT);
+            $data['title'] = s($data['title']);
         }
         if (isset($data['description'])) {
             $data['description'] = clean_param($data['description'], PARAM_CLEANHTML);
@@ -946,7 +946,7 @@ public function update_column(int $columnid, array $data): void {
             'autohide' => $data['autohide'],
         ];
         if (isset($data['title'])) {
-            $data['title'] = clean_param($data['title'], PARAM_TEXT);
+            $data['title'] = s($data['title']);
         }
         $columndata = [
             'id' => $columnid,

diff --git a/lib.php b/lib.php
@@ -159,17 +159,15 @@ function kanban_inplace_editable($itemtype, $itemid, $newvalue) {
 
     \mod_kanban\helper::check_permissions_for_user_or_group($boardmanager->get_board(), $context, $boardmanager->get_cminfo());
 
-    $newtitle = clean_param($newvalue, PARAM_TEXT);
-
     if ($itemtype == 'card') {
-        $boardmanager->update_card($itemid, ['title' => $newtitle]);
+        $boardmanager->update_card($itemid, ['title' => $newvalue]);
     }
 
     if ($itemtype == 'column') {
-        $boardmanager->update_column($itemid, ['title' => $newtitle]);
+        $boardmanager->update_column($itemid, ['title' => $newvalue]);
     }
 
-    return new \core\output\inplace_editable('mod_kanban', $itemtype, $itemid, true, $newtitle, $newtitle, null, '');
+    return new \core\output\inplace_editable('mod_kanban', $itemtype, $itemid, true, $newvalue, $newvalue, null, '');
 }
 
 /**

diff --git a/templates/card.mustache b/templates/card.mustache
@@ -36,7 +36,7 @@
             <span class="inplaceeditable inplaceeditable-text"{{#canedit}}{{^completed}} data-inplaceeditable="1" data-component="mod_kanban" data-itemtype="card" data-itemid="{{id}}"
         data-value="{{title}}" data-type="text"{{/completed}}{{/canedit}}>
                 <a href="#" class="quickeditlink aalink"{{#canedit}}{{^completed}} data-inplaceeditablelink="1"{{/completed}}{{/canedit}}>
-                {{title}}
+                {{{title}}}
                 </a>
             </span>
         </div>

diff --git a/templates/column.mustache b/templates/column.mustache
@@ -34,7 +34,7 @@
     <span class="inplaceeditable inplaceeditable-text"{{#managecolumns}} {{^locked}}data-inplaceeditable="1" {{/locked}}data-component="mod_kanban" data-itemtype="column" data-itemid="{{id}}"
     data-value="{{title}}" data-type="text"{{/managecolumns}}>
         <a href="#" class="quickeditlink aalink"{{#managecolumns}} data-inplaceeditablelink="1"{{/managecolumns}}>
-            {{title}}
+            {{{title}}}
         </a>
     </span>
     </h5>