Attendance: add remove_xss

Author: jmontoyaa

main/gradebook/lib/GradebookUtils.php

@@ -961,7 +961,7 @@ public static function load_gradebook_select_in_tool($form)
                             $select_gradebook->addOption(get_lang('Default'), $my_cat->get_id());
                             $cats_added[] = $my_cat->get_id();
                         } else {
-                            $select_gradebook->addOption($my_cat->get_name(), $my_cat->get_id());
+                            $select_gradebook->addOption(Security::remove_XSS($my_cat->get_name()), $my_cat->get_id());
                             $cats_added[] = $my_cat->get_id();
                         }
                     } else {

main/inc/lib/attendance.lib.php

@@ -181,13 +181,26 @@ public static function get_attendance_data(
                 ) || api_is_drh();
                 if (api_is_allowed_to_edit(null, true) || $isDrhOfCourse) {
                     // Link to edit
-                    $attendance[1] = '<a href="index.php?'.api_get_cidreq().'&action=attendance_sheet_list&attendance_id='.$attendance[0].$student_param.'">'.$attendance[1].'</a>'.$session_star;
+                    $attendance[1] = '<a 
+                        href="index.php?'.api_get_cidreq().'&action=attendance_sheet_list&attendance_id='.$attendance[0].$student_param.'">'.
+                        Security::remove_XSS($attendance[1]).
+                        '</a>'.
+                        $session_star;
                 } else {
                     // Link to view
-                    $attendance[1] = '<a href="index.php?'.api_get_cidreq().'&action=attendance_sheet_list_no_edit&attendance_id='.$attendance[0].$student_param.'">'.$attendance[1].'</a>'.$session_star;
+                    $attendance[1] = '<a 
+                        href="index.php?'.api_get_cidreq().'&action=attendance_sheet_list_no_edit&attendance_id='.$attendance[0].$student_param.'">'.
+                        Security::remove_XSS($attendance[1]).
+                        '</a>'.
+                        $session_star;
                 }
             } else {
-                $attendance[1] = '<a class="muted" href="index.php?'.api_get_cidreq().'&action=attendance_sheet_list&attendance_id='.$attendance[0].$student_param.'">'.$attendance[1].'</a>'.$session_star;
+                $attendance[1] = '<a 
+                    class="muted" 
+                    href="index.php?'.api_get_cidreq().'&action=attendance_sheet_list&attendance_id='.$attendance[0].$student_param.'">'.
+                    Security::remove_XSS($attendance[1]).
+                    '</a>'.
+                    $session_star;
             }
 
             if ($attendance[5] == 1) {
@@ -198,9 +211,7 @@ public static function get_attendance_data(
 
             $attendance[3] = '<center>'.$attendance[3].'</center>';
             if (api_is_allowed_to_edit(null, true)) {
-                $actions = '';
-                $actions .= '<center>';
-
+                $actions = '<center>';
                 if (api_is_platform_admin()) {
                     $actions .= '<a href="index.php?'.api_get_cidreq().'&action=attendance_edit&attendance_id='.$attendance[0].'">'.
                         Display::return_icon('edit.png', get_lang('Edit'), [], ICON_SIZE_SMALL).'</a>&nbsp;';
@@ -268,7 +279,7 @@ public static function get_attendance_data(
                 $attendances[] = [
                     $attendance[0],
                     $attendance[1],
-                    $attendance[2],
+                    Security::remove_XSS($attendance[2]),
                     $attendance[3],
                     $actions,
                 ];
@@ -277,7 +288,7 @@ public static function get_attendance_data(
                 $attendances[] = [
                     $attendance[0],
                     $attendance[1],
-                    $attendance[2],
+                    Security::remove_XSS($attendance[2]),
                     $attendance[3],
                 ];
             }
@@ -2326,7 +2337,7 @@ public function getCoursesWithAttendance(
             false
         );
         /* Get course with (in_category) and without (not_category) category */
-        foreach ($courses as $coursesKey => $courseData) {
+        foreach ($courses as $courseData) {
             /*
              * $coursesKey can be in_category or not_category for courses
              * */