Survey: add remove_xss

Author: jmontoyaa

main/survey/preview.php

@@ -55,22 +55,22 @@
 SurveyUtil::check_first_last_question($surveyId, false);
 
 // Survey information
-echo '<div class="page-header"><h2>'.$survey_data['survey_title'].'</h2></div>';
+echo '<div class="page-header"><h2>'.Security::remove_XSS($survey_data['survey_title']).'</h2></div>';
 if (!empty($survey_data['survey_subtitle'])) {
-    echo '<div id="survey_subtitle">'.$survey_data['survey_subtitle'].'</div>';
+    echo '<div id="survey_subtitle">'.Security::remove_XSS($survey_data['survey_subtitle']).'</div>';
 }
 
 // Displaying the survey introduction
 if (!isset($_GET['show'])) {
     if (!empty($survey_data['survey_introduction'])) {
-        echo '<div class="survey_content">'.$survey_data['survey_introduction'].'</div>';
+        echo '<div class="survey_content">'.Security::remove_XSS($survey_data['survey_introduction']).'</div>';
     }
 }
 
 // Displaying the survey thanks message
 if (isset($_POST['finish_survey'])) {
     echo Display::return_message(get_lang('SurveyFinished'), 'confirm');
-    echo $survey_data['survey_thanks'];
+    echo Security::remove_XSS($survey_data['survey_thanks']);
     Display::display_footer();
     exit;
 }

main/survey/surveyUtil.class.php

@@ -3472,6 +3472,8 @@ public static function get_survey_data(
         $efv = new ExtraFieldValue('survey');
         while ($survey = Database::fetch_array($res)) {
             $array[0] = $survey[0];
+            $survey[1] = Security::remove_XSS($survey[1]);
+
             if (self::checkHideEditionToolsByCode($survey['col2'])) {
                 $array[1] = $survey[1];
             } else {
@@ -3711,6 +3713,8 @@ public static function getSurveyList($user_id)
                 continue;
             }
 
+            $title = Security::remove_XSS($row['title']);
+
             echo '<tr>';
             if ($row['answered'] == 0) {
                 echo '<td>';
@@ -3723,7 +3727,7 @@ public static function getSurveyList($user_id)
                 );
                 echo '<a href="'.$url.'">
                     '.$icon
-                    .$row['title']
+                    .$title
                     .'</a></td>';
             } else {
                 $isDrhOfCourse = CourseManager::isUserSubscribedInCourseAsDrh(
@@ -3748,7 +3752,7 @@ public static function getSurveyList($user_id)
                             'survey_id' => $row['survey_id'],
                         ])
                     )
-                    : $icon.PHP_EOL.$row['title'];
+                    : $icon.PHP_EOL.$title;
                 echo '</td>';
             }
             echo '<td class="text-center">';
@@ -3762,7 +3766,6 @@ public static function getSurveyList($user_id)
                 echo '<td class="text-center">'.($efvMandatory['value'] ? get_lang('Yes') : get_lang('No')).'</td>';
             }
             echo '</tr>';
-
             $surveyIds[] = $row['survey_id'];
         }
         echo '</tbody>';