Index: lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java =================================================================== diff -u -r5796487652c87809a4f4a27fbf3a890499e4845d -r093c79d081e1eaa1a2158602d0a946ba94112d64 --- lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java (.../MainExportServlet.java) (revision 5796487652c87809a4f4a27fbf3a890499e4845d) +++ lams_learning/src/java/org/lamsfoundation/lams/learning/export/web/action/MainExportServlet.java (.../MainExportServlet.java) (revision 093c79d081e1eaa1a2158602d0a946ba94112d64) @@ -47,6 +47,7 @@ import javax.servlet.http.HttpSession; import org.apache.commons.io.FileUtils; +import org.apache.commons.lang.StringEscapeUtils; import org.apache.log4j.Logger; import org.lamsfoundation.lams.learning.export.ExportPortfolioConstants; import org.lamsfoundation.lams.learning.export.ExportPortfolioException; @@ -227,12 +228,12 @@ */ private void replaceImageFolderLinks(String filename, String contentFolderID, String learnerContentFolder) { try { - // String to find - String ckeditorpath = "/*lams/+www/+secure/+" + contentFolderID; + // ((\\\\)?/)* stands for any number of slashes(/) or escaped slashes(\/, which was produced by running StringEscapeUtils.escapeJavaScript() beforehand) + String ckeditorpath = "((\\\\)?/)*lams((\\\\)?/)+www((\\\\)?/)+secure((\\\\)?/)+" + contentFolderID; String ckeditorrecpath = "../" + contentFolderID + "/Recordings"; String ckeditorsmiley = "/lams/ckeditor/images/smiley"; String ckeditorvr = "/lams/ckeditor/plugins/videorecorder"; - String learnerContentPath = "/+lams/+www/+secure/+" + learnerContentFolder; + String learnerContentPath = "((\\\\)?/)+lams((\\\\)?/)+www((\\\\)?/)+secure((\\\\)?/)+" + learnerContentFolder.replaceAll("/", "((\\\\\\\\)?/)+"); // Replacing string String newckeditorpath = "../" + contentFolderID; Index: lams_tool_assessment/src/java/org/lamsfoundation/lams/tool/assessment/service/AssessmentServiceImpl.java =================================================================== diff -u -r7817bc4fce30416c9737875ae2d137be0c6aa8ba -r093c79d081e1eaa1a2158602d0a946ba94112d64 --- lams_tool_assessment/src/java/org/lamsfoundation/lams/tool/assessment/service/AssessmentServiceImpl.java (.../AssessmentServiceImpl.java) (revision 7817bc4fce30416c9737875ae2d137be0c6aa8ba) +++ lams_tool_assessment/src/java/org/lamsfoundation/lams/tool/assessment/service/AssessmentServiceImpl.java (.../AssessmentServiceImpl.java) (revision 093c79d081e1eaa1a2158602d0a946ba94112d64) @@ -40,6 +40,7 @@ import java.util.TreeSet; import java.util.regex.Pattern; +import org.apache.commons.lang.StringEscapeUtils; import org.apache.commons.lang.StringUtils; import org.apache.log4j.Logger; import org.apache.struts.upload.FormFile; @@ -806,6 +807,10 @@ // private methods // ***************************************************************************** + /** + * Escapes all characters that may brake JS code on assigning Java value to JS String variable (particularly + * escapes all quotes in the following way \"). + */ private static void escapeQuotes(Object object) { if (object instanceof UserSummary) { UserSummary userSummary = (UserSummary) object; @@ -844,24 +849,28 @@ private static void escapeQuotesInQuestionResult(AssessmentQuestionResult questionResult) { String answerString = questionResult.getAnswerString(); if (answerString != null) { - questionResult.setAnswerString(answerString.replaceAll("[\"]", """)); + answerString = StringEscapeUtils.escapeJavaScript(answerString); + questionResult.setAnswerString(answerString); } AssessmentQuestion question = questionResult.getAssessmentQuestion(); String title = question.getTitle(); if (title != null) { - question.setTitle(title.replaceAll("[\"]", """)); + title = StringEscapeUtils.escapeJavaScript(title); + question.setTitle(title); } for (AssessmentQuestionOption questionOption : question.getQuestionOptions()) { String questionStr = questionOption.getQuestion(); if (questionStr != null) { - questionOption.setQuestion(questionStr.replaceAll("[\"]", """)); + questionStr = StringEscapeUtils.escapeJavaScript(questionStr); + questionOption.setQuestion(questionStr); } String optionStr = questionOption.getOptionString(); if (optionStr != null) { - questionOption.setOptionString(optionStr.replaceAll("[\"]", """)); + optionStr = StringEscapeUtils.escapeJavaScript(optionStr); + questionOption.setOptionString(optionStr); } } }