Escape institution_display_name correctly (Bug #1447377)

Institution names were not being escaped properly in the
accesslist.

This patch escapes them properly as well as clearing the
compiled cache for the templates where this problem occurs.

Change-Id: I2e675af0b84a3a7106e0245a5faa6ee2095a7e06
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

htdocs/lib/db/upgrade.php

@@ -4024,5 +4024,11 @@ function xmldb_core_upgrade($oldversion=0) {
         }
     }
 
+    if ($oldversion < 2015042800) {
+        require_once(get_config('libroot').'dwoo/dwoo/Dwoo/Core.php');
+        @unlink(get_config('dataroot') . 'dwoo/compile/default' . get_config('docroot') . 'theme/raw/' . 'templates/view/accesslistrow.tpl.d'.Dwoo_Core::RELEASE_TAG.'.php');
+        @unlink(get_config('dataroot') . 'dwoo/compile/default' . get_config('docroot') . 'theme/raw/' . 'templates/admin/users/accesslistitem.tpl.d'.Dwoo_Core::RELEASE_TAG.'.php');
+    }
+
     return $status;
 }

htdocs/lib/institution.php

@@ -977,7 +977,7 @@ function build_institutions_html($filter, $showdefault, $query, $limit, $offset,
 }
 
 function institution_display_name($name) {
-    return get_field('institution', 'displayname', 'name', $name);
+    return hsc(get_field('institution', 'displayname', 'name', $name));
 }
 
 /**

htdocs/lib/version.php

@@ -16,7 +16,7 @@ $config = new stdClass();
 // See https://wiki.mahara.org/index.php/Developer_Area/Version_Numbering_Policy
 // For upgrades on stable branches, increment the version by one.  On master, use the date.
 
-$config->version = 2015041400;
+$config->version = 2015042800;
 $config->series = '15.10';
 $config->release = '15.10dev';
 $config->minupgradefrom = 2009022600;