Release 2.53 (#5878)

assets/js/plugins/KimaiAPILink.js

@@ -74,9 +74,6 @@ export default class KimaiAPILink extends KimaiPlugin {
         const successHandle = () => {
             EVENTS.trigger(eventName);
             document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
-            if (attributes['msgSuccess'] !== undefined) {
-                ALERT.success(attributes['msgSuccess']);
-            }
         };
         const errorHandle = (error) => {
             let message = 'action.update.error';

assets/js/plugins/KimaiEscape.js

@@ -10,6 +10,7 @@
  */
 
 import KimaiPlugin from "../KimaiPlugin";
+import DOMPurify from "dompurify";
 
 export default class KimaiEscape extends KimaiPlugin {
 
@@ -26,14 +27,23 @@ export default class KimaiEscape extends KimaiPlugin {
             return '';
         }
 
-        const tagsToReplace = {
+        const charToReplace = {
             '&': '&',
             '<': '&lt;',
             '>': '&gt;',
+            '"': '&quot;',
         };
 
-        return title.replace(/[&<>]/g, function(tag) {
-            return tagsToReplace[tag] || tag;
+        return title.replace(/[&<>"]/g, function(tag) {
+            return charToReplace[tag] || tag;
         });
     }
+
+    /**
+     * @param {string} html
+     * @returns {string}
+     */
+    sanitize(html) {
+        return DOMPurify.sanitize(html);
+    }
 }