Fix for bugs #2368 and #2369

SoObjects/Appointments/SOGoAptMailNotification.m

@@ -140,9 +140,14 @@
   return newEndDate;
 }
 
+- (NSString *) location
+{
+  return [[apt location] stringByEscapingHTMLString];
+}
+
 - (NSString *) summary
 {
-  return [apt summary];
+  return [[apt summary] stringByEscapingHTMLString];
 }
 
 - (void) setOrganizerName: (NSString *) theString

UI/MailPartViewers/UIxMailPartICalViewer.m

@@ -1,6 +1,7 @@
 /*
   Copyright (C) 2004-2005 SKYRIX Software AG
-  
+  Copyright (C) 2006-2013 Inverse inc.
+
   This file is part of SOGo.
 
   SOGo is free software; you can redistribute it and/or modify it under

UI/MailerUI/UIxMailListActions.m

@@ -753,7 +753,7 @@
       // To
       to = [[message objectForKey: @"envelope"] to];
       if ([to count] > 0)
-	[msg addObject: [addressFormatter stringForArray: to]];
+	[msg addObject: [[addressFormatter stringForArray: to] stringByEscapingHTMLString]];
       else
 	[msg addObject: @""];
 
@@ -778,7 +778,7 @@
       // From
       from = [[message objectForKey: @"envelope"] from];
       if ([from count] > 0)
-	[msg addObject: [addressFormatter stringForArray: from]];
+	[msg addObject: [[addressFormatter stringForArray: from] stringByEscapingHTMLString]];
       else
 	[msg addObject: @""];
       

UI/Templates/Appointments/SOGoAptMailInvitation.wox

@@ -24,9 +24,9 @@ h1, dd, .dl-list dt { margin-left: 130px; }
       <small><var:string value="organizerName" const:escapeHTML="NO"/><var:string value="sentByText" const:escapeHTML="NO"/></small></h1>
 
       <dl class="dl-horizontal">
-        <var:if condition="apt.location.length"
+        <var:if condition="location.length"
         ><dt><var:string label:value="location_label" const:escapeHTML="NO"/></dt>
-        <dd><var:string value="apt.location" const:escapeHTML="NO"/></dd></var:if>
+        <dd><var:string value="location" const:escapeHTML="NO"/></dd></var:if>
         <dt><var:string label:value="startDate_label" const:escapeHTML="NO"/></dt>
         <dd><var:string value="formattedAptStartDate" const:escapeHTML="NO"
            /><var:if condition="formattedAptStartTime.length"> - <var:string value="formattedAptStartTime" const:escapeHTML="NO"/> <var:string value="viewTZ" const:escapeHTML="NO"/>

UI/WebServerResources/SchedulerUI.js

@@ -748,14 +748,14 @@ function onViewEventCallback(http) {
             para = $(paras[1]);
             if (data["calendar"].length) {
  		// Remove owner email from calendar's name
-                para.down("SPAN", 1).update(data["calendar"].replace(/ \<.*\>/, ""));
+                para.down("SPAN", 1).update(data["calendar"].escapeHTML());
                 para.show();
             } else
                 para.hide();
 
             para = $(paras[2]);
             if (data["location"].length) {
-                para.down("SPAN", 1).update(data["location"]);
+                para.down("SPAN", 1).update(data["location"].escapeHTML());
                 para.show();
             } else
                 para.hide();