make sure we escape html chars after type ans comp. (#960)

This commit is contained in:
Damien Elmes 2013-09-20 14:57:05 +09:00
parent 7eabc36468
commit fe3ce87020

View file

@ -472,11 +472,11 @@ Please run Tools>Empty Cards""")
"Diff-corrects the typed-in answer." "Diff-corrects the typed-in answer."
givenElems, correctElems = self.tokenizeComparison(given, correct) givenElems, correctElems = self.tokenizeComparison(given, correct)
def good(s): def good(s):
return "<span class=typeGood>"+s+"</span>" return "<span class=typeGood>"+cgi.escape(s)+"</span>"
def bad(s): def bad(s):
return "<span class=typeBad>"+s+"</span>" return "<span class=typeBad>"+cgi.escape(s)+"</span>"
def missed(s): def missed(s):
return "<span class=typeMissed>"+s+"</span>" return "<span class=typeMissed>"+cgi.escape(s)+"</span>"
if given == correct: if given == correct:
res = good(given) res = good(given)
else: else: