escape customer, project and activity name in javascript (#2959)

assets/js/KimaiPlugin.js

@@ -66,4 +66,19 @@ export default class KimaiPlugin {
         return this.getContainer().getPlugin(name);
     }
 
+    /**
+     * @param {string} title
+     * @returns {string}
+     */
+    escape(title) {
+        const tagsToReplace = {
+            '&': '&',
+            '<': '&lt;',
+            '>': '&gt;',
+        };
+
+        return title.replace(/[&<>]/g, function(tag) {
+            return tagsToReplace[tag] || tag;
+        });
+    };
 }

assets/js/plugins/KimaiRecentActivities.js

@@ -65,9 +65,10 @@ export default class KimaiRecentActivities extends KimaiPlugin {
 
         for (let timesheet of entries) {
             let label = this.attributes['template']
-                .replace('%customer%', timesheet.project.customer.name)
+                .replace('%customer%', this.escape(timesheet.project.customer.name))
-                .replace('%project%', timesheet.project.name)
+                .replace('%project%', this.escape(timesheet.project.name))
-                .replace('%activity%', timesheet.activity.name);
+                .replace('%activity%', this.escape(timesheet.activity.name))
+            ;
 
             htmlToInsert +=
                 `<li>` +

public/build/entrypoints.json

@@ -3,7 +3,7 @@
     "app": {
       "js": [
         "build/runtime.b8e7bb04.js",
-        "build/app.3947eaef.js"
+        "build/app.9e8f68cf.js"
       ],
       "css": [
         "build/app.3bc2b4d9.css"

public/build/manifest.json

@@ -1,6 +1,6 @@
 {
   "build/app.css": "build/app.3bc2b4d9.css",
-  "build/app.js": "build/app.3947eaef.js",
+  "build/app.js": "build/app.9e8f68cf.js",
   "build/invoice.css": "build/invoice.ff32661a.css",
   "build/invoice.js": "build/invoice.19f36eca.js",
   "build/invoice-pdf.css": "build/invoice-pdf.9a7468ef.css",