Fixed variable output in JS templates.

OTRS · Apr 2, 2019 · b99cad2 · b99cad2
1 parent 6cd28b8
commit b99cad2
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 15 deletions.
diff --git a/...tput/JavaScript/Templates/Standard/Agent/AppointmentCalendar/AppointmentTooltip.html.tmpl b/...tput/JavaScript/Templates/Standard/Agent/AppointmentCalendar/AppointmentTooltip.html.tmpl
@@ -27,16 +27,16 @@
     <fieldset>
         <legend><span>{{ 'Basic information' | Translate }}</span></legend>
         <label>{{ 'Title' | Translate }}:</label>
-        <p class="Value">{{ CalEvent.title | safe }}</p>
+        <p class="Value">{{ CalEvent.title }}</p>
         <div class="Clear"></div>
     {% if CalEvent.description %}
         <label>{{ 'Description' | Translate }}:</label>
-        <p class="Value">{{ CalEvent.description | safe }}</p>
+        <p class="Value">{{ CalEvent.description }}</p>
         <div class="Clear"></div>
     {% endif %}
     {% if CalEvent.location %}
         <label>{{ 'Location' | Translate }}:</label>
-        <p class="Value">{{ CalEvent.location | safe }}</p>
+        <p class="Value">{{ CalEvent.location }}</p>
         <div class="Clear"></div>
     {% endif %}
         <label>{{ 'Calendar' | Translate }}:</label>
@@ -52,17 +52,17 @@
     <fieldset>
         <legend><span>{{ 'Resource' | Translate }}</span></legend>
         <label>{{ 'Team' | Translate }}:</label>
-        <p class="Value"> {{ CalEvent.teamNames | replace('\\n', '<br>') | safe }}</p>
+        <p class="Value"> {{ CalEvent.teamNames | escape | replace('\\n', '<br>') | safe }}</p>
         <div class="Clear"></div>
     {% if CalEvent.resourceNames %}
         <label>{{ 'Agent' | Translate }}:</label>
-        <p class="Value">{{ CalEvent.resourceNames | replace('\\n', '<br>') | safe }}</p>
+        <p class="Value">{{ CalEvent.resourceNames | escape | replace('\\n', '<br>') | safe }}</p>
         <div class="Clear"></div>
     {% endif %}
     </fieldset>
 {% endif %}
     <fieldset>
-        <legend><span>{{ 'Date/Time' | Translate}}</span></legend>
+        <legend><span>{{ 'Date/Time' | Translate }}</span></legend>
         <label>{{ 'Start date' | Translate }}:</label>
         <p class="Value">{{ CalEvent.startDate }}</p>
         <div class="Clear"></div>
@@ -85,7 +85,7 @@
         <legend><span>{{ 'Link' | Translate }}</span></legend>
     {% for PluginKey, PluginValue in PluginList %}
         <label>{{ PluginValue.PluginName }}:</label>
-        <p class="Value">{{ CalEvent.pluginData[PluginKey] | safe }}</p>
+        <p class="Value">{{ CalEvent.pluginData[PluginKey] | escape | replace('\\n', '<br>') | safe }}</p>
         <div class="Clear"></div>
     {% endfor %}
     </fieldset>

diff --git a/Kernel/Output/JavaScript/Templates/Standard/AjaxDnDUpload/AttachmentItem.html.tmpl b/Kernel/Output/JavaScript/Templates/Standard/AjaxDnDUpload/AttachmentItem.html.tmpl
@@ -7,10 +7,10 @@
 # --
 
 <tr style="display: none;">
-    <td class="Filename">{{ Filename | safe }}</td>
-    <td class="Filetype">{{ Filetype | safe }}</td>
-    <td class="Filesize">{{ Filesize | safe }}</td>
+    <td class="Filename">{{ Filename }}</td>
+    <td class="Filetype">{{ Filetype }}</td>
+    <td class="Filesize">{{ Filesize }}</td>
     <td class="Center">
-        <a href="#" data-file-id="{{ FileID | safe }}" class="AttachmentDelete"><i class="fa fa-trash"></i></a>
+        <a href="#" data-file-id="{{ FileID }}" class="AttachmentDelete"><i class="fa fa-trash"></i></a>
     </td>
 </tr>
diff --git a/Kernel/Output/JavaScript/Templates/Standard/AjaxDnDUpload/AttachmentItemUploading.html.tmpl b/Kernel/Output/JavaScript/Templates/Standard/AjaxDnDUpload/AttachmentItemUploading.html.tmpl
@@ -7,8 +7,8 @@
 # --
 
 <tr class="Hidden Uploading">
-    <td class="Filename">{{ Filename | safe }}</td>
-    <td class="Filetype">{{ Filetype | safe }}</td>
+    <td class="Filename">{{ Filename }}</td>
+    <td class="Filetype">{{ Filetype }}</td>
     <td class="Filesize">
         <span class="Progress"></span>
     </td>

diff --git a/Kernel/Output/JavaScript/Templates/Standard/SysConfig/BreadCrumbItem.html.tmpl b/Kernel/Output/JavaScript/Templates/Standard/SysConfig/BreadCrumbItem.html.tmpl
@@ -7,5 +7,5 @@
 # --
 
 <li>
-    <a title="{{ Title }}" href="{{ URL | safe}}">{{ Title }}</a>
+    <a title="{{ Title }}" href="{{ URL }}">{{ Title }}</a>
 </li>
diff --git a/var/httpd/htdocs/js/Core.Agent.AppointmentCalendar.js b/var/httpd/htdocs/js/Core.Agent.AppointmentCalendar.js
@@ -1376,7 +1376,7 @@ Core.Agent.AppointmentCalendar = (function (TargetNS) {
 
                             // Overwrite option text, because of wrong html quoting of text content.
                             // (This is needed for IE.)
-                            NewOption.innerHTML = Value;
+                            NewOption.innerHTML = Core.App.EscapeHTML(Value);
 
                             // Restore selection
                             if (SelectedID && SelectedID.indexOf(Index) > -1) {