I disagree about Moodle site solution

I disagree about Moodle site solution

by Daniele Cordella -
Number of replies: 3
Picture of Core developers Picture of Plugin developers
I found a bug and I disagree about Moodle site solution.
Error description:
Create a quiz
start it and than save it without sending it.
Return to it
use italian language (course language).
Have to access the quiz through the button labeled "Continua l'ultimo tentativo".
Button labeled "Continua l'ultimo tentativo" text comes from /moodle/lang/it/quiz.php
and the push button is built by the code that is in /moodle/mod/quiz/view_js.php.

In the /moodle/mod/quiz/view_js.php file is written

<script Xlanguage="javascript" type="text/javascript">
<!--
document.write('<input type="button" value="<?php echo $buttontext ?>" '+
'Xonclick="javascript: <?php if ($quiz->timelimit and !$unfinished) echo "if (confirm('$strconfirmstartattempt'))"; ?> '+
'window.open('attempt.php?id=<?php echo $cm->id ?>', '<?php echo $window ?>', '<?php echo $windowoptions ?>'); " />');
// -->
</script>

This means that the process doesn't work if a "'" is in the label.

The error has been corrected by changing the $string['continueattemptquiz'] from "Continua l'ultimo tentativo" to "Riprendi ultimo tentativo" that is without "'".
Fine but... this is not a solution it is only a workaround.

I believe that the right solution could be the correction of the /moodle/mod/quiz/view_js.php file to

<script Xlanguage="javascript" type="text/javascript">
<!--
document.write('<input type="button" value="<?php echo htmlspecialchars($buttontext,ENT_QUOTES) ?>" '+
'Xonclick="javascript: <?php if ($quiz->timelimit and !$unfinished) echo "if (confirm('$strconfirmstartattempt'))"; ?> '+
'window.open('attempt.php?id=<?php echo $cm->id ?>', '<?php echo $window ?>', '<?php echo $windowoptions ?>'); " />');
// -->
</script>

otherwise final users cannot change strings on their own needs.

Any comment?
Is here something that I am missing?
Average of ratings: -
In reply to Daniele Cordella

Re: I disagree about Moodle site solution

by Yves Dufour -
isn't something related with your file encoding ?
using backslah before single quote doesn't work ?
As I am working with a Mac and French language I had this kind of problem when not taking care of my file encoding. thoughtful
In reply to Yves Dufour

Re: I disagree about Moodle site solution

by Daniele Cordella -
Picture of Core developers Picture of Plugin developers
Yes backslash works but...
1) the string in /moodle/lang/it/quiz.php is "Continua l\'ultimo tentativo"
2) so the php variable reads "Continua l\'ultimo tentativo" and understands "Continua l'ultimo tentativo"
and
3) java create the mistake.

A correct sintax for the initial string in /moodle/lang/it/quiz.php (because of java) should be "Continua l\\\'ultimo tentativo"
In this way
1) the string in /moodle/lang/it/quiz.php is "Continua l\\\'ultimo tentativo"
2) the php variable reads "Continua l\\\'ultimo tentativo" and understands "Continua l\'ultimo tentativo"
and
3) java correctly uses "Continua l\'ultimo tentativo"

Was I clear?
In reply to Daniele Cordella

Re: I disagree about Moodle site solution

by Yves Dufour -
Found that... maybe it can help.. to be adapted of course to your problem :

<?php
//$ident = 'img_two';
//$name = "Ginny's Wedding";
//$location = 'data/293/0/cover3.jpg';

function js_escape_string( $text ) {
return addcslashes( $text, ''\"'."\n\r" );
}

$id = htmlspecialchars( $ident );
$src = htmlspecialchars( $location );
$alt = htmlspecialchars( $name );
$onmouseover = htmlspecialchars( "switchit('" . js_escape_string( $name ) . "');" );
$onmouseout = htmlspecialchars( 'clearit();' );
printf(
'%s',
$id, $src, $alt, $onmouseover, $onmouseout
);
?>

Function "js_escape_string" is designed to escape strings the way the JavaScript
expects, so they can be placed as part of JavaScript strings. "htmlspecialchars"
is used to change characters which are special in HTML to their entity representation
(it'll work OK for attribute values enclosed with double quotes, if you want to
use single quotes, then you'll have to use "htmlspecialchars" function optional
parameter to make it also encode single quote char).

"addslashes" function should not be used in place of "addcslashes" because
it does NOT escape many chars that JavaScript requires to be escaped.
If you'll notice that some character that should be escaped for JS is not
escaped, then add it to the second parameter of "addcslashes" in
"js_escape_string" function (you should escape "<" and ">" chars if the
string is inside ", but you
do not have to escape those chars if the JavaScript code is in HTML
attribute value).