Escape output, attach the autocompleter in the template

diff --git a/kronolith/new.php b/kronolith/new.php
index 98a6433..06e2a31 100644 (file)
--- a/kronolith/new.php
+++ b/kronolith/new.php
@@ -75,6 +75,5 @@ require KRONOLITH_TEMPLATES . '/common-header.inc';
 require KRONOLITH_TEMPLATES . '/menu.inc';
 require KRONOLITH_TEMPLATES . '/edit/javascript.inc';
 require KRONOLITH_TEMPLATES . '/edit/edit.inc';
-Kronolith_Imple::factory('TagAutoCompleter', array('triggerId' => 'tags', 'id' => $event->getUID()));
 
 require $registry->get('templates', 'horde') . '/common-footer.inc';

diff --git a/kronolith/templates/edit/edit.inc b/kronolith/templates/edit/edit.inc
index 7f7236c..5c37d5d 100644 (file)
--- a/kronolith/templates/edit/edit.inc
+++ b/kronolith/templates/edit/edit.inc
@@ -367,7 +367,7 @@ endif;
 <tr>
 <td colspan="5" class="control toggle" onclick="toggleSection('tags')">
  <?php echo Horde::img('tree/blank.png', '', array('id' => 'toggle_tags'), $GLOBALS['registry']->getImageDir('horde')) . ' <strong>' . _("Tags") ?></strong>
-  <span class="extra" id="extra_tags"><?php echo (!empty($tags) ? $tags : '');?></span>
+  <span class="extra" id="extra_tags"><?php echo (!empty($tags) ? htmlspecialchars($tags) : '');?></span>
   </td>
 </tr>
 <tr id="section_tags">
@@ -375,12 +375,12 @@ endif;
      <strong><?php echo Horde::label('tags', _("Tags"))?></strong>
  </td>
  <td colspan="4">
-   <input type="text" name="tags" id="tags" value="<?php echo (!empty($tags) ? $tags : '')?>" size="40" />
-   <div id="tags_results" class="autocomplete"></div>
+   <input type="text" name="tags" id="tags" value="<?php echo (!empty($tags) ? htmlspecialchars($tags) : '')?>" size="40" />
+   <div id="tags_results" name="tags_results" class="autocomplete"></div>
    <span id="tags_loading_img" style="display:none;"><?php echo Horde::img('loading.gif', _("Loading...")) ?></span>
  </td>
 </tr>
-
+<?php Kronolith_Imple::factory('TagAutoCompleter', array('triggerId' => 'tags', 'id' => $event->getUID())); ?>
 <!-- spacer -->
 <tr>
  <td style="line-height:4px;">&nbsp;</td>