From c9b05b32fad0b2014f757233d9dad83aa7333d62 Mon Sep 17 00:00:00 2001
From: moodler <moodler>
Date: Mon, 31 May 2004 05:11:22 +0000
Subject: [PATCH] Some fixes to HTML quoting in calendar popups.

Fixes bug 1502.
---
 calendar/lib.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/calendar/lib.php b/calendar/lib.php
index d0815fc904..4958c390f6 100644
--- a/calendar/lib.php
+++ b/calendar/lib.php
@@ -194,7 +194,7 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupalt  = '';
                 } else if ($event->courseid > 1 and empty($event->groupid)) {      // Course event
                     $popupicon = $CFG->pixpath.'/c/course.gif';
-                   $popupalt  = '';
+                    $popupalt  = '';
                 } else if ($event->groupid) {                                      // Group event
                     $popupicon = $CFG->pixpath.'/c/group.gif';
                     $popupalt  = '';
@@ -202,10 +202,11 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupicon = $CFG->pixpath.'/c/user.gif';
                     $popupalt  = '';
                 }
-                $popupcontent .= '<div><img height=16 width=16 src=\\\''.$popupicon.'\\\' style=\\\'vertical-align: middle; margin-right: 4px;\\\' alt=\\\''.$popupalt.'\\\' /><a href=\\\''.$dayhref.'\\\'>'.addslashes(htmlspecialchars($event->name)).'</a></div>';
+                $popupcontent .= '<div><img height=16 width=16 src="'.$popupicon.'" style="vertical-align: middle; margin-right: 4px;" alt="'.$popupalt.'" /><a href="'.$dayhref.'">'.$event->name.'</a></div>';
             }
 
             $popupcaption = get_string('eventsfor', 'calendar', userdate($events[$eventid]->timestart, $strftimetimedayshort));
+            $popupcontent = str_replace("'", "\'", htmlSpecialChars($popupcontent));
             $popup = 'onmouseover="return overlib(\''.$popupcontent.'\', CAPTION, \''.$popupcaption.'\');" onmouseout="return nd();"';
 
             // Class and cell content
-- 
2.39.5