The thank you page header is not filtered, resolves #664.

lucaboesch · lucaboesch · commit 93b06002c285 · 2025-09-30T10:53:33.000+02:00
diff --git a/questionnaire.class.php b/questionnaire.class.php
@@ -2520,7 +2520,7 @@ private function response_goto_thankyou() {
             $this->page->add_to_page('progressbar',
                     $this->renderer->render_progress_bar(count($this->questionsbysec) + 1, $this->questionsbysec));
         }
-        $this->page->add_to_page('title', $thankhead);
+        $this->page->add_to_page('title', format_string($thankhead));
         $this->page->add_to_page('addinfo',
             format_text(file_rewrite_pluginfile_urls($thankbody, 'pluginfile.php',
                 $this->context->id, 'mod_questionnaire', 'thankbody', $this->survey->id), FORMAT_HTML, ['noclean' => true]));

Original file line number	Diff line number	Diff line change
`@@ -2520,7 +2520,7 @@ private function response_goto_thankyou() {`
`2520`	`2520`	`$this->page->add_to_page('progressbar',`
`2521`	`2521`	`$this->renderer->render_progress_bar(count($this->questionsbysec) + 1, $this->questionsbysec));`
`2522`	`2522`	`}`
`2523`		`- $this->page->add_to_page('title', $thankhead);`
	`2523`	`+ $this->page->add_to_page('title', format_string($thankhead));`
`2524`	`2524`	`$this->page->add_to_page('addinfo',`
`2525`	`2525`	`format_text(file_rewrite_pluginfile_urls($thankbody, 'pluginfile.php',`
`2526`	`2526`	`$this->context->id, 'mod_questionnaire', 'thankbody', $this->survey->id), FORMAT_HTML, ['noclean' => true]));`