Escape the popover title for special HTML characters.

alextselegidis · Apr 5, 2023 · 2255c84 · 2255c84
1 parent 87a114a
commit 2255c84
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/assets/js/utils/calendar_default_view.js b/assets/js/utils/calendar_default_view.js
@@ -734,7 +734,7 @@ App.Utils.CalendarDefaultView = (function () {
 
         $target.popover({
             placement: 'top',
-            title: info.event.title,
+            title: App.Utils.String.escapeHtml(info.event.title),
             content: $html,
             html: true,
             container: '#calendar',

diff --git a/assets/js/utils/calendar_table_view.js b/assets/js/utils/calendar_table_view.js
@@ -1406,7 +1406,7 @@ App.Utils.CalendarTableView = (function () {
 
         $target.popover({
             placement: 'top',
-            title: info.event.title,
+            title: App.Utils.String.escapeHtml(info.event.title),
             content: $html,
             html: true,
             container: '#calendar',