Fix course description text see BT#15259

main/course_description/course_description_controller.php

@@ -73,7 +73,7 @@ class CourseDescriptionController
             }
             // Add an escape version for the JS code of delete confirmation
             if ($description) {
-                $data['descriptions'][$id]['title_js'] = addslashes($description['title']);
+                $data['descriptions'][$id]['title_js'] = addslashes(strip_tags($description['title']));
             }
         }
         $actions = null;

main/template/default/course_description/index.tpl

@@ -9,12 +9,12 @@
                 {% if is_allowed_to_edit %}
                     <div class="pull-right">
                         {% if session_id == description.session_id %}
-                            <a href="{{ _p.web_self }}?action=edit&amp;id={{ description.id }}&amp;{{ _p.web_cid_query }}"
+                            <a href="{{ _p.web_self }}?action=edit&id={{ description.id }}&{{ _p.web_cid_query }}"
                                title="{{ 'Edit'|get_lang }}">
                                 <img src="{{ 'edit.png'|icon(22) }}"/>
                             </a>
-                            <a href="{{ _p.web_self }}?action=delete&amp;id={{ description.id }}&amp;{{ _p.web_cid_query }}"
-                               onclick="javascript:return confirmation('{{ description.title_js }}');"
+                            <a href="{{ _p.web_self }}?action=delete&id={{ description.id }}&{{ _p.web_cid_query }}"
+                               onclick = "javascript:return confirmation('{{ description.title_js | e('js') }}');"
                                title="{{ 'Delete'|get_lang }}">
                                 <img src="{{ 'delete.png'|icon(22) }}"/>
                             </a>