From 347ad614507183035d188ba14427bc162419778c Mon Sep 17 00:00:00 2001
From: Brady Miller <brady.g.miller@gmail.com>
Date: Wed, 26 Jan 2022 00:13:24 -0800
Subject: [PATCH] some bug fixes (#4818)

---
 .../calendar/modules/PostCalendar/pnadmin.php |  2 +-
 .../controllers/browse/view/plans_config.php  | 32 +++++-----
 .../www/js/cdr-multiselect/ui.multiselect.js  | 58 +++++++++----------
 library/classes/TreeMenu.php                  |  4 +-
 4 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/interface/main/calendar/modules/PostCalendar/pnadmin.php b/interface/main/calendar/modules/PostCalendar/pnadmin.php
index 8045d489db5..aa3a787b9a1 100644
--- a/interface/main/calendar/modules/PostCalendar/pnadmin.php
+++ b/interface/main/calendar/modules/PostCalendar/pnadmin.php
@@ -229,7 +229,7 @@ function postcalendar_admin_categoriesConfirm()
         $output->FormHidden("newactive", $newactive);
         $output->FormHidden("newsequence", $newsequence);
         $output->FormHidden("newaco", $newaco);
-        $output->Text(_PC_ADD_CAT . $newname . '.');
+        $output->Text(_PC_ADD_CAT . text($newname) . '.');
         $output->Linebreak();
     }
     $output->Text(_PC_MODIFY_CATS);
diff --git a/interface/super/rules/controllers/browse/view/plans_config.php b/interface/super/rules/controllers/browse/view/plans_config.php
index 2286b73f68f..5e43ee3f363 100644
--- a/interface/super/rules/controllers/browse/view/plans_config.php
+++ b/interface/super/rules/controllers/browse/view/plans_config.php
@@ -23,11 +23,11 @@
 <link rel="stylesheet" href="<?php css_src('cdr-multiselect/ui.multiselect.css') ?>" />
 <link rel="stylesheet" href="<?php css_src('cdr-multiselect/plans_config.css') ?>" />
 
-<script src="<?php js_src('/cdr-multiselect/jquery.min.js') ?>"></script>
-<script src="<?php js_src('/cdr-multiselect/jquery-ui.min.js') ?>"></script>
-<script src="<?php js_src('/cdr-multiselect/plugins/localisation/jquery.localisation-min.js') ?>"></script>
-<script src="<?php js_src('/cdr-multiselect/plugins/scrollTo/jquery.scrollTo-min.js') ?>"></script>
-<script src="<?php js_src('/cdr-multiselect/ui.multiselect.js') ?>"></script>
+<script src="<?php js_src('cdr-multiselect/jquery.min.js') ?>"></script>
+<script src="<?php js_src('cdr-multiselect/jquery-ui.min.js') ?>"></script>
+<script src="<?php js_src('cdr-multiselect/plugins/localisation/jquery.localisation-min.js') ?>"></script>
+<script src="<?php js_src('cdr-multiselect/plugins/scrollTo/jquery.scrollTo-min.js') ?>"></script>
+<script src="<?php js_src('cdr-multiselect/ui.multiselect.js?v=' . $GLOBALS['v_js_includes']) ?>"></script>
 <script>
 // Below variables are to be used in the javascript for the cdr-multiselect(from cdr-multiselect/locale/ui-multiselect-cdr.js)
 $.extend($.ui.multiselect.locale, {
@@ -52,7 +52,7 @@
             var data = $.parseJSON(resp);
 
             $.each(data, function(idx, obj) {
-                $('<option id="' + obj.plan_id + '" p_id="' + obj.plan_pid + '" value="' + obj.plan_id + '">' + obj.plan_title + '</option>')
+                $('<option id="' + jsAttr(obj.plan_id) + '" p_id="' + jsAttr(obj.plan_pid) + '" value="' + jsAttr(obj.plan_id) + '">' + jsText(obj.plan_title) + '</option>')
                     .insertAfter('#select_plan')
                     .insertBefore('#divider');
             });
@@ -178,7 +178,7 @@
                 if (obj.status_code == '000') {
                     //Success
                     if (is_new_plan) {
-                        $('<option id="' + obj.plan_id + '" value="' + obj.plan_id + '">' + obj.plan_title + '</option>')
+                        $('<option id="' + jsAttr(obj.plan_id) + '" value="' + jsAttr(obj.plan_id) + '">' + jsText(obj.plan_title) + '</option>')
                             .insertAfter('#select_plan')
                             .insertBefore('#divider')
                             .attr("selected","selected");
@@ -250,7 +250,7 @@
             $.post
                 (
                     '<?php echo  _base_url() .
-                            '/library/RulesPlanMappingEventHandlers_ajax.php?action=getRulesInAndNotInPlan&plan_id='; ?>' + selected_plan
+                            '/library/RulesPlanMappingEventHandlers_ajax.php?action=getRulesInAndNotInPlan&plan_id='; ?>' + encodeURIComponent(selected_plan)
                 )
                 .done(function(resp) {
                     var data = $.parseJSON(resp);
@@ -262,12 +262,12 @@
                         if (obj.selected  == "true") {
                             $("#cdr_rules_select")
                                 .append(
-                                    $('<option value="' + obj.rule_id + '" selected="selected" init_value="selected">' + obj.rule_title + '</option>')
+                                    $('<option value="' + jsAttr(obj.rule_id) + '" selected="selected" init_value="selected">' + jsText(obj.rule_title) + '</option>')
                                 );
                         } else {
                             $("#cdr_rules_select")
                                 .append(
-                                    $('<option value="' + obj.rule_id + '" init_value="not-selected">' + obj.rule_title + '</option>')
+                                    $('<option value="' + jsAttr(obj.rule_id) + '" init_value="not-selected">' + jsText(obj.rule_title) + '</option>')
                                 );
                         }
                     });
@@ -300,14 +300,14 @@
         })
         .fail(function (jqXHR, textStatus) {
             console.log(textStatus);
-            alert('<?php echo xls('Error'); ?>');
+            alert(<?php echo xlj('Error'); ?>);
         });
 
     }
 
     $newPlan = function() {
         $('#new_plan_container')
-                        .append('<?php echo '<label>' . xla('Plan Name') . ': </label>'; ?>')
+                        .append('<label>' + jsText(<?php echo xlj('Plan Name'); ?>) + ': </label>')
             .append('<input id="new_plan_name" type="text" name="new_plan_name">');
 
         $("#cdr-rules_cont").removeClass("overlay");
@@ -349,19 +349,19 @@
     }
 
     $activatePlan = function() {
-        $("#plan-status-label").text('<?php echo xla('Status') . ': ' . xla('Active{{Plan}}'); ?>');
+        $("#plan-status-label").text(jsText(<?php echo xlj('Status'); ?>) + ': ' + jsText(<?php echo xlj('Active{{Plan}}'); ?>));
         window.buttonStatus = "active";
         $("#cdr-status").removeAttr("disabled");
-        $("#cdr-status").text('<?php echo xla('Deactivate'); ?>');
+        $("#cdr-status").text(jsText(<?php echo xlj('Deactivate'); ?>));
 
         $("#cdr-rules_cont").removeClass("overlay");
     }
 
     $deactivatePlan = function() {
-        $("#plan-status-label").text('<?php echo xla('Status') . ': ' . xla('Inactive'); ?>');
+        $("#plan-status-label").text(jsText(<?php echo xlj('Status'); ?>) + ': ' + jsText(<?php echo xlj('Inactive'); ?>));
         window.buttonStatus = "inactive";
         $("#cdr-status").removeAttr("disabled");
-        $("#cdr-status").text('<?php echo xla('Activate'); ?>');
+        $("#cdr-status").text(jsText(<?php echo xlj('Activate'); ?>));
 
         $("#cdr-rules_cont").addClass("overlay");
     }
diff --git a/interface/super/rules/www/js/cdr-multiselect/ui.multiselect.js b/interface/super/rules/www/js/cdr-multiselect/ui.multiselect.js
index 33a2aaf879b..5159834aedb 100644
--- a/interface/super/rules/www/js/cdr-multiselect/ui.multiselect.js
+++ b/interface/super/rules/www/js/cdr-multiselect/ui.multiselect.js
@@ -4,13 +4,13 @@
  * Authors:
  *  Michael Aufreiter (quasipartikel.at)
  *  Yanick Rochon (yanick.rochon[at]gmail[dot]com)
- * 
+ *
  * Dual licensed under the MIT (MIT-LICENSE.txt)
  * and GPL (GPL-LICENSE.txt) licenses.
- * 
+ *
  * http://www.quasipartikel.at/multiselect/
  *
- * 
+ *
  * Depends:
  *	ui.core.js
  *	ui.sortable.js
@@ -18,7 +18,7 @@
  * Optional:
  * localization (http://plugins.jquery.com/project/localisation)
  * scrollTo (http://plugins.jquery.com/project/ScrollTo)
- * 
+ *
  * Todo:
  *  Make batch actions faster
  *  Implement dynamic insertion through remote calls
@@ -53,7 +53,7 @@ $.widget("ui.multiselect", {
 		this.availableActions = $('<div class="actions ui-widget-header ui-helper-clearfix"><input type="text" class="search empty ui-widget-content ui-corner-all"/><a href="#" class="add-all">'+$.ui.multiselect.locale.addAll+'</a></div>').appendTo(this.availableContainer);
 		this.selectedList = $('<ul class="selected connected-list"><li class="ui-helper-hidden-accessible"></li></ul>').bind('selectstart', function(){return false;}).appendTo(this.selectedContainer);
 		this.availableList = $('<ul class="available connected-list"><li class="ui-helper-hidden-accessible"></li></ul>').bind('selectstart', function(){return false;}).appendTo(this.availableContainer);
-		
+
 		var that = this;
 
 		// set dimensions
@@ -64,15 +64,15 @@ $.widget("ui.multiselect", {
 		// fix list height to match <option> depending on their individual header's heights
 		this.selectedList.height(Math.max(this.element.height()-this.selectedActions.height(),1));
 		this.availableList.height(Math.max(this.element.height()-this.availableActions.height(),1));
-		
+
 		if ( !this.options.animated ) {
 			this.options.show = 'show';
 			this.options.hide = 'hide';
 		}
-		
+
 		// init lists
 		this._populateLists(this.element.find('option'));
-		
+
 		// make selection sortable
 		if (this.options.sortable) {
 			this.selectedList.sortable({
@@ -90,7 +90,7 @@ $.widget("ui.multiselect", {
 					// increment count
 					that.count += 1;
 					that._updateCount();
-					// workaround, because there's no way to reference 
+					// workaround, because there's no way to reference
 					// the new element, see http://dev.jqueryui.com/ticket/4303
 					that.selectedList.children('.ui-draggable').each(function() {
 						$(this).removeClass('ui-draggable');
@@ -98,31 +98,31 @@ $.widget("ui.multiselect", {
 						$(this).data('idx', ui.item.data('idx'));
 						that._applyItemState($(this), true);
 					});
-			
+
 					// workaround according to http://dev.jqueryui.com/ticket/4088
 					setTimeout(function() { ui.item.remove(); }, 1);
 				}
 			});
 		}
-		
+
 		// set up livesearch
 		if (this.options.searchable) {
 			this._registerSearchEvents(this.availableContainer.find('input.search'));
 		} else {
 			$('.search').hide();
 		}
-		
+
 		// batch actions
 		this.container.find(".remove-all").click(function() {
 			that._populateLists(that.element.find('option').removeAttr('selected'));
 			return false;
 		});
-		
+
 		this.container.find(".add-all").click(function() {
 			var options = that.element.find('option').not(":selected");
 			if (that.availableList.children('li:hidden').length > 1) {
 				that.availableList.children('li').each(function(i) {
-					if ($(this).is(":visible")) $(options[i-1]).attr('selected', 'selected'); 
+					if ($(this).is(":visible")) $(options[i-1]).attr('selected', 'selected');
 				});
 			} else {
 				options.attr('selected', 'selected');
@@ -151,7 +151,7 @@ $.widget("ui.multiselect", {
 			item.data('idx', i);
 			return item[0];
     }));
-		
+
 		// update count
 		this._updateCount();
 		that._filter.apply(this.availableContainer.find('input.search'), [that.availableList]);
@@ -161,7 +161,7 @@ $.widget("ui.multiselect", {
 	},
 	_getOptionNode: function(option) {
 		option = $(option);
-		var node = $('<li class="ui-state-default ui-element" title="'+option.text()+'"><span class="ui-icon"/>'+option.text()+'<a href="#" class="action"><span class="ui-corner-all ui-icon"/></a></li>').hide();
+		var node = $('<li class="ui-state-default ui-element" title="' + jsAttr(option.text()) + '"><span class="ui-icon"/>' + jsText(option.text()) + '<a href="#" class="action"><span class="ui-corner-all ui-icon"/></a></li>').hide();
 		node.data('optionLink', option);
 		return node;
 	},
@@ -180,11 +180,11 @@ $.widget("ui.multiselect", {
 			var selectedItem = this._cloneWithData(item);
 			item[this.options.hide](this.options.animated, function() { $(this).remove(); });
 			selectedItem.appendTo(this.selectedList).hide()[this.options.show](this.options.animated);
-			
+
 			this._applyItemState(selectedItem, true);
 			return selectedItem;
 		} else {
-			
+
 			// look for successor based on initial option index
 			var items = this.availableList.find('li'), comparator = this.options.nodeComparator;
 			var succ = null, i = item.data('idx'), direction = comparator(item, $(items[i]));
@@ -202,12 +202,12 @@ $.widget("ui.multiselect", {
 			} else {
 				succ = items[i];
 			}
-			
+
 			var availableItem = this._cloneWithData(item);
 			succ ? availableItem.insertBefore($(succ)) : availableItem.appendTo(this.availableList);
 			item[this.options.hide](this.options.animated, function() { $(this).remove(); });
 			availableItem.hide()[this.options.show](this.options.animated);
-			
+
 			this._applyItemState(availableItem, false);
 			return availableItem;
 		}
@@ -220,13 +220,13 @@ $.widget("ui.multiselect", {
 				item.children('span').removeClass('ui-icon-arrowthick-2-n-s').addClass('ui-helper-hidden').removeClass('ui-icon');
 			item.find('a.action span').addClass('ui-icon-minus').removeClass('ui-icon-plus');
 			this._registerRemoveEvents(item.find('a.action'));
-			
+
 		} else {
 			item.children('span').removeClass('ui-icon-arrowthick-2-n-s').addClass('ui-helper-hidden').removeClass('ui-icon');
 			item.find('a.action span').addClass('ui-icon-plus').removeClass('ui-icon-minus');
 			this._registerAddEvents(item.find('a.action'));
 		}
-		
+
 		this._registerDoubleClickEvents(item);
 		this._registerHoverEvents(item);
 	},
@@ -235,12 +235,12 @@ $.widget("ui.multiselect", {
 		var input = $(this);
 		var rows = list.children('li'),
 			cache = rows.map(function(){
-				
+
 				return $(this).text().toLowerCase();
 			});
-		
+
 		var term = $.trim(input.val().toLowerCase()), scores = [];
-		
+
 		if (!term) {
 			rows.show();
 		} else {
@@ -278,7 +278,7 @@ $.widget("ui.multiselect", {
 			that._updateCount();
 			return false;
 		});
-		
+
 		// make draggable
 		if (this.options.sortable) {
   		elements.each(function() {
@@ -293,7 +293,7 @@ $.widget("ui.multiselect", {
   				containment: that.container,
   				revert: 'invalid'
   	    });
-  		});		  
+  		});
 		}
 	},
 	_registerRemoveEvents: function(elements) {
@@ -323,7 +323,7 @@ $.widget("ui.multiselect", {
 		});
 	}
 });
-		
+
 $.extend($.ui.multiselect, {
 	locale: {
 		addAll:'Add all',
@@ -333,4 +333,4 @@ $.extend($.ui.multiselect, {
 });
 
 
-})(jQuery);
\ No newline at end of file
+})(jQuery);
diff --git a/library/classes/TreeMenu.php b/library/classes/TreeMenu.php
index 15cf004a6e0..fb91031ec3d 100755
--- a/library/classes/TreeMenu.php
+++ b/library/classes/TreeMenu.php
@@ -796,7 +796,7 @@ function toHTML()
         }
 
         if ($this->promoText) {
-            return sprintf('<option value="">%s</option>%s', $this->promoText, $nodeHTML);
+            return sprintf('<option value="">%s</option>%s', text($this->promoText ?? ''), $nodeHTML);
         } else {
             return $nodeHTML;
         }
@@ -809,7 +809,7 @@ function toHTML()
     */
     function _nodeToHTML($node, $prefix = '')
     {
-        $html = sprintf('<option value="%s">%s%s</option>', $node->id, $prefix, $node->text);
+        $html = sprintf('<option value="%s">%s%s</option>', attr($node->id), $prefix, text($node->text));
 
         /**
         * Loop through subnodes