jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

escape data in calendar popover (#2960)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-19 22:57:03 +01:00
committed by GitHub
parent 89bfa82c61
commit 9470699798
9 changed files with 51 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
templates/calendar/user.html.twig
View File

@@ -120,11 +120,13 @@
function renderEventPopoverContent(eventObj)
{
const escaper = kimai.getPlugin('escape');
return '<div class="calendar-entry">' +
'<ul>' +
'<li>' + '{{ 'label.customer'|trans }}: ' + eventObj.customer + '</li>' +
'<li>' + '{{ 'label.project'|trans }}: ' + eventObj.project + '</li>' +
'<li>' + '{{ 'label.activity'|trans }}: ' + eventObj.activity + '</li>' +
'<li>' + '{{ 'label.customer'|trans }}: ' + escaper.escapeForHtml(eventObj.customer) + '</li>' +
'<li>' + '{{ 'label.project'|trans }}: ' + escaper.escapeForHtml(eventObj.project) + '</li>' +
'<li>' + '{{ 'label.activity'|trans }}: ' + escaper.escapeForHtml(eventObj.activity) + '</li>' +
'</ul>' +
(eventObj.description !== null || eventObj.tags.length > 0 ? '<hr>' : '') +
(eventObj.description ? '<p>' + eventObj.description + '</p>' : '') +