From 1c635acc60d16027b7c36e27b806a55d05af6528 Mon Sep 17 00:00:00 2001
From: Peter Mayer <admin@pemasoft.de>
Date: Sat, 17 Oct 2026 02:18:27 +0200
Subject: [PATCH] MBS-11472: Escape section name in activity selector

---
 mod_form.php                        | 3 ++-
 templates/activityselector.mustache | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/mod_form.php b/mod_form.php
index ad9c7892..43df097b 100644
--- a/mod_form.php
+++ b/mod_form.php
@@ -48,7 +48,8 @@ public function definition(): void {
         // Gets only sections with content.
         foreach ($cm->get_sections() as $sectionnum => $section) {
             $sectioninfo = $cm->get_section_info($sectionnum);
-            $s['name'] = $sectioninfo->name;
+            // Not escaped here, the template escapes it.
+            $s['name'] = format_string($sectioninfo->name, true, ['context' => $this->context, 'escape' => false]);
             if (empty($s['name'])) {
                 $s['name'] = get_string('section') . ' ' . $sectionnum;
             }
diff --git a/templates/activityselector.mustache b/templates/activityselector.mustache
index f4af534c..1e2c4ab0 100644
--- a/templates/activityselector.mustache
+++ b/templates/activityselector.mustache
@@ -68,7 +68,7 @@
     <div class="card-text">{{#str}} activity, core {{/str}}
     <select id="learningmap-activity-selector">
     {{#sections}}
-        <optgroup label="{{#shortentext}} 30, {{{name}}} {{/shortentext}}">
+        <optgroup label="{{#shortentext}} 30, {{name}} {{/shortentext}}">
         {{#coursemodules}}
         {{^completionenabled}}
         <option value="{{id}}" disabled class="learningmap-disabled-activity" title="{{#str}} nocompletionenabled, learningmap {{/str}}">{{#shortentext}} 30, {{{name}}} {{/shortentext}}</option>