Course description: Remove XSS when showing title

AngelFQC · AngelFQC · commit b21663fdf79c · 2025-09-01T12:16:48.000-05:00
See advisory GHSA-p32q-6gh3-3gcv
diff --git a/main/inc/lib/course.lib.php b/main/inc/lib/course.lib.php
@@ -3481,7 +3481,7 @@ public static function get_details_course_description_html(
                     );
                     $data .= '</a> ';
                 }
-                $data .= $description->getTitle();
+                $data .= Security::remove_XSS($description->getTitle());
                 $data .= '</div>';
                 $data .= '<div class="sectioncomment">';
                 $data .= Security::remove_XSS($description->getContent());

Original file line number	Diff line number	Diff line change
`@@ -3481,7 +3481,7 @@ public static function get_details_course_description_html(`
`3481`	`3481`	`);`
`3482`	`3482`	`$data .= '</a> ';`
`3483`	`3483`	`}`
`3484`		`- $data .= $description->getTitle();`
	`3484`	`+ $data .= Security::remove_XSS($description->getTitle());`
`3485`	`3485`	`$data .= '</div>';`
`3486`	`3486`	`$data .= '<div class="sectioncomment">';`
`3487`	`3487`	`$data .= Security::remove_XSS($description->getContent());`