Some fixes to HTML quoting in calendar popups.

Fixes bug 1502.
nilo72 · May 31, 2004 · c9b05b3 · c9b05b3
1 parent 558a1ed
commit c9b05b3
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/calendar/lib.php b/calendar/lib.php
@@ -194,18 +194,19 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupalt  = '';
                 } else if ($event->courseid > 1 and empty($event->groupid)) {      // Course event
                     $popupicon = $CFG->pixpath.'/c/course.gif';
-                   $popupalt  = '';
+                    $popupalt  = '';
                 } else if ($event->groupid) {                                      // Group event
                     $popupicon = $CFG->pixpath.'/c/group.gif';
                     $popupalt  = '';
                 } else if ($event->userid) {                                       // User event
                     $popupicon = $CFG->pixpath.'/c/user.gif';
                     $popupalt  = '';
                 }
-                $popupcontent .= '<div><img height=16 width=16 src=\\\''.$popupicon.'\\\' style=\\\'vertical-align: middle; margin-right: 4px;\\\' alt=\\\''.$popupalt.'\\\' /><a href=\\\''.$dayhref.'\\\'>'.addslashes(htmlspecialchars($event->name)).'</a></div>';
+                $popupcontent .= '<div><img height=16 width=16 src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'">'.$event->name.'</a></div>';
             }
 
             $popupcaption = get_string('eventsfor', 'calendar', userdate($events[$eventid]->timestart, $strftimetimedayshort));
+            $popupcontent = str_replace("'", "\'", htmlSpecialChars($popupcontent));
             $popup = 'onmouseover="return overlib(\''.$popupcontent.'\', CAPTION, \''.$popupcaption.'\');" onmouseout="return nd();"';
 
             // Class and cell content