From 22f7bae5aeb3aa6d3b4fe12934e3bdfbdac7e8bf Mon Sep 17 00:00:00 2001
From: m-lopez-f <miguel.lopez@artica.es>
Date: Wed, 15 Mar 2017 12:07:06 +0100
Subject: [PATCH] Fixed problems with htmld tags in list events and other view
 that include list of events. Gitlab: #529

---
 pandora_console/include/ajax/events.php                 | 2 +-
 pandora_console/include/functions_events.php            | 4 ++--
 pandora_console/operation/events/events.build_table.php | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pandora_console/include/ajax/events.php b/pandora_console/include/ajax/events.php
index 90059a8fd4..6d30983b7e 100644
--- a/pandora_console/include/ajax/events.php
+++ b/pandora_console/include/ajax/events.php
@@ -53,7 +53,7 @@ if ($get_event_name) {
 		return;
 	}
 	
-	ui_print_truncate_text(io_safe_output($name), 75, false, false, false, '...');
+	ui_print_truncate_text(strip_tags(io_safe_output($name)), 75, false, false, false, '...');
 	
 	return;
 }
diff --git a/pandora_console/include/functions_events.php b/pandora_console/include/functions_events.php
index e001e00f90..8c11eb1316 100644
--- a/pandora_console/include/functions_events.php
+++ b/pandora_console/include/functions_events.php
@@ -970,7 +970,7 @@ function events_print_event_table ($filter = "", $limit = 10, $width = 440, $ret
 			$data[2] = events_print_type_img ($event["event_type"], true);
 			
 			/* Event text */
-			$data[3] = ui_print_string_substr (io_safe_output($event["evento"]), 75, true, '7.5');
+			$data[3] = ui_print_string_substr (strip_tags(io_safe_output($event["evento"])), 75, true, '7.5');
 			
 			if($agent_id == 0) {
 				if ($event["id_agente"] > 0) {
@@ -2336,7 +2336,7 @@ function events_page_general ($event) {
 	
 	$data = array();
 	$data[0] = __('Event name');
-	$data[1] = io_safe_output(io_safe_output($event["evento"]));
+	$data[1] = strip_tags(io_safe_output($event["evento"]));
 	$table_general->data[] = $data;
 	
 	$data = array();
diff --git a/pandora_console/operation/events/events.build_table.php b/pandora_console/operation/events/events.build_table.php
index 906cd840df..303fdcc435 100644
--- a/pandora_console/operation/events/events.build_table.php
+++ b/pandora_console/operation/events/events.build_table.php
@@ -415,11 +415,11 @@ else {
 		
 		if (in_array('evento', $show_fields)) {
 			// Event description
-			$data[$i] = '<span title="'.$event["evento"].'" class="f9">';
+			$data[$i] = '<span title="' . strip_tags(io_safe_output($event["evento"])) . '" class="f9">';
 			if($allow_action) {
 				$data[$i] .= '<a href="javascript:" onclick="show_event_dialog(' . $event["id_evento"] . ', '.$group_rep.');">';
 			}
-			$data[$i] .= '<span class="'.$myclass.'" style="font-size: 7.5pt;">' . ui_print_truncate_text (io_safe_output($event["evento"]), 160) . '</span>';
+			$data[$i] .= '<span class="' . $myclass . '" style="font-size: 7.5pt;">' . ui_print_truncate_text (strip_tags(io_safe_output($event["evento"])), 160) . '</span>';
 			if($allow_action) {
 				$data[$i] .= '</a>';
 			}
@@ -695,7 +695,7 @@ else {
 			}
 			
 			$data[$i] .= '<a href="javascript:" onclick="show_event_dialog(' . $event["id_evento"] . ', '.$group_rep.');">';
-			$data[$i] .= html_print_input_hidden('event_title_'.$event["id_evento"], "#".$event["id_evento"]." - ".$event["evento"], true);
+			$data[$i] .= html_print_input_hidden('event_title_'.$event["id_evento"], "#".$event["id_evento"]." - " . strip_tags(io_safe_output($event["evento"])), true);
 			$data[$i] .= html_print_image ("images/eye.png", true,
 				array ("title" => __('Show more')));
 			$data[$i] .= '</a>';