Fix escaping in email notification template

[friendica.git] / mod / events.php

diff --git a/mod/events.php b/mod/events.php
index 81ab79c722e09c895ea752608bc33a94df0f7e3a..f147e005459ab85f1b7c21710007c368a833254e 100644 (file)
--- a/mod/events.php
+++ b/mod/events.php
@@ -9,6 +9,8 @@ use Friendica\Content\Nav;
 use Friendica\Content\Widget\CalendarExport;
 use Friendica\Core\ACL;
 use Friendica\Core\L10n;
+use Friendica\Core\Logger;
+use Friendica\Core\Renderer;
 use Friendica\Core\System;
 use Friendica\Core\Worker;
 use Friendica\Database\DBA;
@@ -17,6 +19,7 @@ use Friendica\Model\Item;
 use Friendica\Model\Profile;
 use Friendica\Module\Login;
 use Friendica\Util\DateTimeFormat;
+use Friendica\Util\Strings;
 use Friendica\Util\Temporal;
 
 require_once 'include/items.php';
@@ -47,7 +50,7 @@ function events_init(App $a)
 function events_post(App $a)
 {
 
-       logger('post: ' . print_r($_REQUEST, true), LOGGER_DATA);
+       Logger::log('post: ' . print_r($_REQUEST, true), Logger::DATA);
 
        if (!local_user()) {
                return;
@@ -57,8 +60,8 @@ function events_post(App $a)
        $cid = !empty($_POST['cid']) ? intval($_POST['cid']) : 0;
        $uid = local_user();
 
-       $start_text  = escape_tags(defaults($_REQUEST, 'start_text', ''));
-       $finish_text = escape_tags(defaults($_REQUEST, 'finish_text', ''));
+       $start_text  = Strings::escapeHtml(defaults($_REQUEST, 'start_text', ''));
+       $finish_text = Strings::escapeHtml(defaults($_REQUEST, 'finish_text', ''));
 
        $adjust   = intval(defaults($_POST, 'adjust', 0));
        $nofinish = intval(defaults($_POST, 'nofinish', 0));
@@ -94,9 +97,9 @@ function events_post(App $a)
        // and we'll waste a bunch of time responding to it. Time that
        // could've been spent doing something else.
 
-       $summary  = escape_tags(trim(defaults($_POST, 'summary', '')));
-       $desc     = escape_tags(trim(defaults($_POST, 'desc', '')));
-       $location = escape_tags(trim(defaults($_POST, 'location', '')));
+       $summary  = Strings::escapeHtml(trim(defaults($_POST, 'summary', '')));
+       $desc     = Strings::escapeHtml(trim(defaults($_POST, 'desc', '')));
+       $location = Strings::escapeHtml(trim(defaults($_POST, 'location', '')));
        $type     = 'event';
 
        $action = ($event_id == '') ? 'new' : "event/" . $event_id;
@@ -224,8 +227,8 @@ function events_content(App $a)
        // get the translation strings for the callendar
        $i18n = Event::getStrings();
 
-       $htpl = get_markup_template('event_head.tpl');
-       $a->page['htmlhead'] .= replace_macros($htpl, [
+       $htpl = Renderer::getMarkupTemplate('event_head.tpl');
+       $a->page['htmlhead'] .= Renderer::replaceMacros($htpl, [
                '$baseurl' => System::baseUrl(),
                '$module_url' => '/events',
                '$modparams' => 1,
@@ -366,9 +369,9 @@ function events_content(App $a)
                }
 
                if (!empty($_GET['id'])) {
-                       $tpl = get_markup_template("event.tpl");
+                       $tpl = Renderer::getMarkupTemplate("event.tpl");
                } else {
-                       $tpl = get_markup_template("events_js.tpl");
+                       $tpl = Renderer::getMarkupTemplate("events_js.tpl");
                }
 
                // Get rid of dashes in key names, Smarty3 can't handle them
@@ -381,7 +384,7 @@ function events_content(App $a)
                        $events[$key]['item'] = $event_item;
                }
 
-               $o = replace_macros($tpl, [
+               $o = Renderer::replaceMacros($tpl, [
                        '$baseurl'   => System::baseUrl(),
                        '$tabs'      => $tabs,
                        '$title'     => L10n::t('Events'),
@@ -496,9 +499,9 @@ function events_content(App $a)
                        $uri = '';
                }
 
-               $tpl = get_markup_template('event_form.tpl');
+               $tpl = Renderer::getMarkupTemplate('event_form.tpl');
 
-               $o .= replace_macros($tpl, [
+               $o .= Renderer::replaceMacros($tpl, [
                        '$post' => System::baseUrl() . '/events',
                        '$eid'  => $eid,
                        '$cid'  => $cid,