From 1779acc84e003920365013ca2d46dbe28a541a5e Mon Sep 17 00:00:00 2001
From: Daniel Poggenpohl <daniel.poggenpohl@fernuni-hagen.de>
Date: Wed, 11 Feb 2026 09:05:30 +0100
Subject: [PATCH 1/2] Fix: arialabel templating must be escaped to prevent e.g.
 double quotes from spilling over

---
 templates/question.mustache | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/question.mustache b/templates/question.mustache
index 6ec7cee..b8fe579 100644
--- a/templates/question.mustache
+++ b/templates/question.mustache
@@ -130,10 +130,10 @@ Expired question: This can happen in preview mode.
 {{#cells}}
         <td class="cell {{ cellclass }}">
 {{#multiple}}
-            <input type="checkbox" name="{{ responseparamname }}" value="1"{{#isreadonly}} disabled="disabled"{{/isreadonly}}{{#ischecked}} checked="checked"{{/ischecked}} aria-label="{{{ arialabel }}}">
+            <input type="checkbox" name="{{ responseparamname }}" value="1"{{#isreadonly}} disabled="disabled"{{/isreadonly}}{{#ischecked}} checked="checked"{{/ischecked}} aria-label="{{ arialabel }}">
 {{/multiple}}
 {{^multiple}}
-            <input type="radio" name="{{ formfieldname }}" value="{{ colindex }}"{{#isreadonly}} disabled="disabled"{{/isreadonly}}{{#ischecked}} checked="checked"{{/ischecked}} aria-label="{{{ arialabel }}}">
+            <input type="radio" name="{{ formfieldname }}" value="{{ colindex }}"{{#isreadonly}} disabled="disabled"{{/isreadonly}}{{#ischecked}} checked="checked"{{/ischecked}} aria-label="{{ arialabel }}">
             <input hidden type="checkbox" id="{{ uniqid }}_{{ cellclass }}" name="{{ responseparamname }}" value="1"{{#ischecked}} checked="checked"{{/ischecked}} aria-hidden="true">
             <label hidden for="{{ uniqid }}_{{ cellclass }}">{{ cellclass }}</label>
 {{/multiple}}

From 085c124d857c74a054fb5b06211d8e8b9ef189cb Mon Sep 17 00:00:00 2001
From: Daniel Poggenpohl <daniel.poggenpohl@fernuni-hagen.de>
Date: Wed, 11 Feb 2026 09:06:34 +0100
Subject: [PATCH 2/2] Fix: aria-label should not contain HTML tags

---
 classes/output/formulation_and_controls.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/classes/output/formulation_and_controls.php b/classes/output/formulation_and_controls.php
index e06da0b..9962221 100644
--- a/classes/output/formulation_and_controls.php
+++ b/classes/output/formulation_and_controls.php
@@ -74,8 +74,8 @@ public function export_for_template(renderer_base $output) {
                 $cellcontext['colindex'] = $colindex;
                 $cellcontext['responseparamname'] = $responseparamname;
                 $a = [
-                    'itemshorttext' => $row->shorttext,
-                    'answershorttext' => $col->shorttext
+                    'itemshorttext' => strip_tags($row->shorttext),
+                    'answershorttext' => strip_tags($col->shorttext)
                 ];
                 $cellcontext['arialabel'] = lang::get('cellarialabel', (object) $a);