Skip to content

Commit f198cd9

Browse files
committed
Fix three issues with display of answers on the problem grader page.
First, if an answer is a checkbox answer with multiple parts checked, then the `&#9070;` character is not handled. This needs the same processing as is done on the past answers page for this. Second, the essay answers can not be put into a `Mojo::Collection` and joined with `<br>` tags. The result of that is a `Mojo::ByteStream` which means that it is not escaped. That was the original point since the `<br>` tags cannot be escaped. However, the answers must be escaped so that answers like `<script>alert('xss attack')</script>` are not executed. So a for loop similar to that used for the checkbox answers must be used. Note that these answers were also wrapped in a redundant `<div>` tag with the same class as the containing `<div>` that is still there, and that was removed. Third, there was a dangling end `</div>` tag for formula answers that was removed.
1 parent 2d11be7 commit f198cd9

1 file changed

Lines changed: 10 additions & 5 deletions

File tree

templates/ContentGenerator/Instructor/ProblemGrader.html.ep

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -175,16 +175,21 @@
175175
: $scores[$i] ? 'color:#060' : 'color:#600' %>">
176176
% if ($answerTypes[$i] && $answerTypes[$i] eq 'essay') {
177177
% # If the answer is an essay answer then display it line by line.
178-
<div class="past-answer">
179-
<%= c(split /\n/, $answers[$i])->join('<br>') =%>
180-
</div>
178+
% my @lines = split /\n/, $answers[$i];
179+
% for (0 .. $#lines - 1) {
180+
<%= $lines[$_] =%><br>
181+
% }
182+
<%= $lines[-1] =%>
181183
% } elsif ($answerTypes[$i] && $answerTypes[$i] eq 'Value (Formula)') {
182184
% # If its a formula then mark it as tex for MathJax.
183185
`<%= $answers[$i] %>`
184-
</div>
185186
% } else {
186187
% # If it isn't an essay or a formula then show it as text.
187-
<%= $answers[$i] %>
188+
% my @parts = split("&#9070;", $answers[$i]);
189+
% for (0 .. $#parts - 1) {
190+
<%= $parts[$_] =%>&#9070;\
191+
% }
192+
<%= $parts[-1] =%>
188193
% }
189194
</div>
190195
% }

0 commit comments

Comments
 (0)