From 87129be682a22ced92aab1723544de2b3b380dde Mon Sep 17 00:00:00 2001
From: "Michael J. Rubinsky" <mrubinsk@horde.org>
Date: Sun, 8 Feb 2009 18:51:10 -0500
Subject: [PATCH] Escape output, attach the autocompleter in the template

---
 kronolith/new.php                 | 1 -
 kronolith/templates/edit/edit.inc | 8 ++++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/kronolith/new.php b/kronolith/new.php
index 98a6433ff..06e2a3186 100644
--- a/kronolith/new.php
+++ b/kronolith/new.php
@@ -75,6 +75,5 @@ require KRONOLITH_TEMPLATES . '/common-header.inc';
 require KRONOLITH_TEMPLATES . '/menu.inc';
 require KRONOLITH_TEMPLATES . '/edit/javascript.inc';
 require KRONOLITH_TEMPLATES . '/edit/edit.inc';
-Kronolith_Imple::factory('TagAutoCompleter', array('triggerId' => 'tags', 'id' => $event->getUID()));
 
 require $registry->get('templates', 'horde') . '/common-footer.inc';
diff --git a/kronolith/templates/edit/edit.inc b/kronolith/templates/edit/edit.inc
index 7f7236cb1..5c37d5d02 100644
--- a/kronolith/templates/edit/edit.inc
+++ b/kronolith/templates/edit/edit.inc
@@ -367,7 +367,7 @@ endif;
 <tr>
 <td colspan="5" class="control toggle" onclick="toggleSection('tags')">
  <?php echo Horde::img('tree/blank.png', '', array('id' => 'toggle_tags'), $GLOBALS['registry']->getImageDir('horde')) . ' <strong>' . _("Tags") ?></strong>
-  <span class="extra" id="extra_tags"><?php echo (!empty($tags) ? $tags : '');?></span>
+  <span class="extra" id="extra_tags"><?php echo (!empty($tags) ? htmlspecialchars($tags) : '');?></span>
   </td>
 </tr>
 <tr id="section_tags">
@@ -375,12 +375,12 @@ endif;
      <strong><?php echo Horde::label('tags', _("Tags"))?></strong>
  </td>
  <td colspan="4">
-   <input type="text" name="tags" id="tags" value="<?php echo (!empty($tags) ? $tags : '')?>" size="40" />
-   <div id="tags_results" class="autocomplete"></div>
+   <input type="text" name="tags" id="tags" value="<?php echo (!empty($tags) ? htmlspecialchars($tags) : '')?>" size="40" />
+   <div id="tags_results" name="tags_results" class="autocomplete"></div>
    <span id="tags_loading_img" style="display:none;"><?php echo Horde::img('loading.gif', _("Loading...")) ?></span>
  </td>
 </tr>
-
+<?php Kronolith_Imple::factory('TagAutoCompleter', array('triggerId' => 'tags', 'id' => $event->getUID())); ?>
 <!-- spacer -->
 <tr>
  <td style="line-height:4px;">&nbsp;</td>
-- 
2.11.0