Project: moodle
Issue MDL-43058: report_security_check_riskxss reports additional name fields in the user object.
The report_security_check_riskxss reports : You need to update your sql to include additional name fields in the user object. line 3580 of /lib/moodlelib.php: call to debugging() line 513 of /report/security/locallib.php: call to fullname() line 74 of /report/security/index.php: call to report_security_check_riskxss() Fix: {code:title=/report/security/locallib.php} if ($detailed) { --$users = $DB->get_records_sql("SELECT DISTINCT u.id, u.firstname, u.lastname, u.picture, u.imagealt $sqlfrom", $params); ++$userfields = user_picture::fields('u'); ++$users = $DB->get_records_sql("SELECT DISTINCT $userfields $sqlfrom", $params); {code}
Story points: 3