escape data in calendar popover (#2960)

assets/js/KimaiLoader.js

@@ -36,6 +36,7 @@ import KimaiDatePicker from "./plugins/KimaiDatePicker";
 import KimaiConfirmationLink from "./plugins/KimaiConfirmationLink";
 import KimaiMultiUpdateTable from "./plugins/KimaiMultiUpdateTable";
 import KimaiDateUtils from "./plugins/KimaiDateUtils";
+import KimaiEscape from "./plugins/KimaiEscape";
 
 export default class KimaiLoader {
 
@@ -48,6 +49,7 @@ export default class KimaiLoader {
             new KimaiTranslation(translations)
         );
 
+        kimai.registerPlugin(new KimaiEscape());
         kimai.registerPlugin(new KimaiEvent());
         kimai.registerPlugin(new KimaiAPI());
         kimai.registerPlugin(new KimaiAlert());

assets/js/KimaiPlugin.js

@@ -71,14 +71,6 @@ export default class KimaiPlugin {
      * @returns {string}
      */
     escape(title) {
-        const tagsToReplace = {
-            '&': '&',
-            '<': '&lt;',
-            '>': '&gt;',
-        };
-
-        return title.replace(/[&<>]/g, function(tag) {
-            return tagsToReplace[tag] || tag;
-        });
+        return this.getPlugin('escape').escapeForHtml(title);
     };
 }

assets/js/plugins/KimaiEscape.js

@@ -0,0 +1,35 @@
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/*!
+ * [KIMAI] KimaiEscape: sanitize strings
+ */
+
+import KimaiPlugin from "../KimaiPlugin";
+
+export default class KimaiEscape extends KimaiPlugin {
+
+    getId() {
+        return 'escape';
+    }
+
+    /**
+     * @param {string} title
+     * @returns {string}
+     */
+    escapeForHtml(title) {
+        const tagsToReplace = {
+            '&': '&',
+            '<': '&lt;',
+            '>': '&gt;',
+        };
+
+        return title.replace(/[&<>]/g, function(tag) {
+            return tagsToReplace[tag] || tag;
+        });
+    };
+}