Some fixes to HTML quoting in calendar popups.

Fixes bug 1502.

diff --git a/calendar/lib.php b/calendar/lib.php
index d0815fc90466717157d49769e02ff16c0f921c7e..4958c390f604a8baaa774d1771d114ca777f004e 100644 (file)
--- a/calendar/lib.php
+++ b/calendar/lib.php
@@ -194,7 +194,7 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupalt  = '';
                 } else if ($event->courseid > 1 and empty($event->groupid)) {      // Course event
                     $popupicon = $CFG->pixpath.'/c/course.gif';
-                   $popupalt  = '';
+                    $popupalt  = '';
                 } else if ($event->groupid) {                                      // Group event
                     $popupicon = $CFG->pixpath.'/c/group.gif';
                     $popupalt  = '';
@@ -202,10 +202,11 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupicon = $CFG->pixpath.'/c/user.gif';
                     $popupalt  = '';
                 }
-                $popupcontent .= '<div><img height=16 width=16 src=\\\''.$popupicon.'\\\' style=\\\'vertical-align: middle; margin-right: 4px;\\\' alt=\\\''.$popupalt.'\\\' /><a href=\\\''.$dayhref.'\\\'>'.addslashes(htmlspecialchars($event->name)).'</a></div>';
+                $popupcontent .= '<div><img height=16 width=16 src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'">'.$event->name.'</a></div>';
             }
 
             $popupcaption = get_string('eventsfor', 'calendar', userdate($events[$eventid]->timestart, $strftimetimedayshort));
+            $popupcontent = str_replace("'", "\'", htmlSpecialChars($popupcontent));
             $popup = 'onmouseover="return overlib(\''.$popupcontent.'\', CAPTION, \''.$popupcaption.'\');" onmouseout="return nd();"';
 
             // Class and cell content