Merge pull request #2797 from nextcloud/backport/2772/stable5

[stable5] fix: properly set string values in exports to escape formulas

Author: susnux

.github/workflows/phpunit-sqlite.yml

@@ -107,7 +107,7 @@ jobs:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
-          coverage: none
+          coverage: xdebug
           ini-file: development
           # Temporary workaround for missing pcntl_* in PHP 8.3
           ini-values: disable_functions=

lib/Service/SubmissionService.php

@@ -311,11 +311,12 @@ private function exportData(array $header, array $data, string $fileFormat, ?Fil
 						->getAlignment()
 						->setWrapText(true);
 				} else {
-					$activeWorksheet->setCellValue([$column, $row], $value);
-
-					// Quote cell values that start with '=' to prevent evaluation of formulas
+					// Explicitly set the type of the value to string for values that start with '=' to prevent it being interpreted as formulas
 					if (is_string($value) && str_starts_with($value, '=')) {
-						$activeWorksheet->getCell([$column, $row])->getStyle()->setQuotePrefix(true);
+						$activeWorksheet->getCell([$column, $row])
+							->setValueExplicit($value);
+					} else {
+						$activeWorksheet->setCellValue([$column, $row], $value);
 					}
 				}
 			}