Poll: reintroduce output encoding

surlabs · Oct 23, 2024 · d62b678 · d62b678
1 parent e60b429
commit d62b678
Showing 1 changed file with 9 additions and 8 deletions.
diff --git a/components/ILIAS/Poll/classes/BlockGUI/Results/class.ilPollResultsRenderer.php b/components/ILIAS/Poll/classes/BlockGUI/Results/class.ilPollResultsRenderer.php
@@ -89,7 +89,7 @@ protected function renderStackedChart(
         $tooltips = [];
         $color_index = 0;
         foreach ($results->getOrderedAnswerIds() as $id) {
-            $label = nl2br($results->getAnswerText($id));
+            $label = $this->htmlSpecialCharsAsEntities($results->getAnswerText($id));
             $total_votes = $results->getAnswerTotal($id);
             $tooltip = $total_votes . ' (' . round($results->getAnswerPercentage($id)) . '%)';
             $bar_config = new BarConfig();
@@ -135,15 +135,11 @@ protected function renderBarChart(
         $dataset = $this->data_factory->dataset([$votes_label => $c_dimension]);
 
         foreach ($results->getOrderedAnswerIds() as $id) {
+            $label = $this->htmlSpecialCharsAsEntities($results->getAnswerText($id));
             $total_votes = $results->getAnswerTotal($id);
             $tooltip = $total_votes . ' (' . round($results->getAnswerPercentage($id)) . '%)';
-            $dataset = $dataset->withPoint(
-                nl2br($results->getAnswerText($id)),
-                [$votes_label => $total_votes]
-            )->withAlternativeInformation(
-                nl2br($results->getAnswerText($id)),
-                [$votes_label => $tooltip]
-            );
+            $dataset = $dataset->withPoint($label, [$votes_label => $total_votes])
+                               ->withAlternativeInformation($label, [$votes_label => $tooltip]);
         }
 
         $bar_config = new BarConfig();
@@ -155,4 +151,9 @@ protected function renderBarChart(
                                                   ->withBarConfigs([$votes_label => $bar_config]);
         $tpl->setVariable('CHART', $this->ui_renderer->render($chart));
     }
+
+    protected function htmlSpecialCharsAsEntities(string $string): string
+    {
+        return $this->refinery->encode()->htmlSpecialCharsAsEntities()->transform(nl2br($string));
+    }
 }