From fcb6881bc83136392e0df1c3fd7ebf25b766ccc8 Mon Sep 17 00:00:00 2001
From: Matheus Zych <mzych@databay.de>
Date: Tue, 14 Jul 2026 07:21:01 +0200
Subject: [PATCH] Test: Fix Unescaped HTML In Kiosk View

See: https://mantis.ilias.de/view.php?id=48066

The participant name in the test kiosk title was inserted as raw HTML,
which could break rendering when the name contained special characters.
The value is now escaped and passed via a legacy UI component.
---
 .../ILIAS/Test/classes/class.ilTestPlayerAbstractGUI.php  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/components/ILIAS/Test/classes/class.ilTestPlayerAbstractGUI.php b/components/ILIAS/Test/classes/class.ilTestPlayerAbstractGUI.php
index f3a03fa28a82..aa5dfa2319cc 100755
--- a/components/ILIAS/Test/classes/class.ilTestPlayerAbstractGUI.php
+++ b/components/ILIAS/Test/classes/class.ilTestPlayerAbstractGUI.php
@@ -3239,8 +3239,12 @@ protected function getTestPlayerTitle(): string
             // this is a placeholder solution with inline html tags to differentiate the different elements
             // should be removed when a title component with grouping and visual weighting is available
             // see:  https://github.com/ILIAS-eLearning/ILIAS/pull/7311
-            $pax_name_value = "<span class='il-test-kiosk-head__participant-name'>"
-                . $this->user->getFullname() . "</span>";
+            $pax_name_value = $this->ui_factory->legacy(
+                sprintf(
+                    "<span class='il-test-kiosk-head__participant-name'>%s</span>",
+                    $this->refinery->encode()->htmlSpecialCharsAsEntities()->transform($this->user->getFullname())
+                )
+            );
             $title_content = $title_content->withProperty($pax_name_label, $pax_name_value, false);
         }