MDL-64372 userpix: Escape fullname string on userpix index page

rboyatt · Jan 8, 2019 · 14f9bad · 14f9bad
1 parent 502650a
commit 14f9bad
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/userpix/index.php b/userpix/index.php
@@ -25,7 +25,7 @@
 
 $rs = $DB->get_recordset_select("user", "deleted = 0 AND picture > 0", array(), "lastaccess DESC", user_picture::fields());
 foreach ($rs as $user) {
-    $fullname = fullname($user);
+    $fullname = s(fullname($user));
     echo "<a href=\"$CFG->wwwroot/user/view.php?id=$user->id&amp;course=1\" ".
          "title=\"$fullname\">";
     echo $OUTPUT->user_picture($user);