use purifyHtml() as in the Text block, fixes #3176

Closes #3176

Merge request studip/studip!2153

lib/models/Courseware/BlockTypes/BiographyAchievements.php

@@ -42,6 +42,21 @@ class BiographyAchievements extends BlockType
         ];
     }
 
+    public function getPayload()
+    {
+        $payload = parent::getPayload();
+        $payload['description'] = \Studip\Markup::purifyHtml(\Studip\Markup::markAsHtml($payload['description']));
+
+        return $payload;
+    }
+
+    public function setPayload($payload): void
+    {
+        $payload['description'] = \Studip\Markup::purifyHtml(\Studip\Markup::markAsHtml($payload['description']));
+
+        parent::setPayload($payload);
+    }
+
     public static function getJsonSchema(): Schema
     {
         $schemaFile = __DIR__.'/BiographyAchievements.json';

lib/models/Courseware/BlockTypes/BiographyGoals.php

@@ -38,6 +38,21 @@ class BiographyGoals extends BlockType
         ];
     }
 
+    public function getPayload()
+    {
+        $payload = parent::getPayload();
+        $payload['description'] = \Studip\Markup::purifyHtml(\Studip\Markup::markAsHtml($payload['description']));
+
+        return $payload;
+    }
+
+    public function setPayload($payload): void
+    {
+        $payload['description'] = \Studip\Markup::purifyHtml(\Studip\Markup::markAsHtml($payload['description']));
+
+        parent::setPayload($payload);
+    }
+
     public static function getJsonSchema(): Schema
     {
         $schemaFile = __DIR__.'/BiographyGoals.json';

resources/vue/components/courseware/CoursewareBiographyAchievementsBlock.vue

@@ -27,7 +27,7 @@
                             {{ $gettext('Enddatum') }}: {{ getReadableDate(currentData.end_date)}}
                         </h4>
                         <h4 v-show="hasParticipation">
-                            {{ $gettext('Beteiligung') }}: <span v-html="currentData.role"></span>
+                            {{ $gettext('Beteiligung') }}: {{ currentData.role }}
                         </h4>
                         <div>
                             <h4>{{ $gettext('Beschreibung') }}:</h4>