Fixing delete category group alert see BT#8016

main/group/group.php

@@ -202,8 +202,14 @@ if (api_get_setting('allow_group_categories') == 'true') {
         if (api_is_allowed_to_edit(false, true)) {
             $actions .= '<a href="group_category.php?'.api_get_cidreq().'&id='.$category['id'].'" title="'.get_lang('Edit').'">'.
                 Display::return_icon('edit.png', get_lang('EditGroup'),'',ICON_SIZE_SMALL).'</a>';
-            $actions .= '<a href="group.php?'.api_get_cidreq().'&action=delete_category&amp;id='.$category['id'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES))."'".')) return false;" title="'.get_lang('Delete').'">'.
-                Display::return_icon('delete.png', get_lang('Delete'),'',ICON_SIZE_SMALL).'</a>';
+            $actions .=
+                Display::url(
+                    Display::return_icon('delete.png', get_lang('Delete'), '', ICON_SIZE_SMALL),
+                    'group.php?'.api_get_cidreq().'&action=delete_category&amp;id='.$category['id'],
+                    array(
+                        'onclick' => 'javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang('ConfirmYourChoice'), ENT_QUOTES))."'".')) return false;'
+                    )
+                );
             if ($index != 0) {
                 $actions .=  ' <a href="group.php?'.api_get_cidreq().'&action=swap_cat_order&amp;id1='.$category['id'].'&amp;id2='.$group_cats[$index -1]['id'].'">'.
                     Display::return_icon('up.png','&nbsp;','',ICON_SIZE_SMALL).'</a>';
@@ -214,7 +220,13 @@ if (api_get_setting('allow_group_categories') == 'true') {
             }
         }
 
-        echo Display::page_header($category['title'].' '. $label.' '.$actions);
+        echo Display::page_header(
+            Security::remove_XSS($category['title'].' '. $label.' ').$actions,
+            null,
+            'h2',
+            false
+        );
+
         echo $category['description'];
         GroupManager::process_groups($group_list, $category['id']);
     }

main/inc/lib/display.lib.php

@@ -1474,30 +1474,47 @@ class Display
         return $html;
     }
 
-    public static function return_default_table_class() {
+    public static function return_default_table_class()
+    {
         return 'data_table';
     }
 
-    public static function page_header($title, $second_title = null, $size = 'h2') {
+    /**
+     * @param string $title
+     * @param string $second_title
+     * @param string $size
+     * @param bool $filter
+     * @return string
+     */
+    public static function page_header($title, $second_title = null, $size = 'h2', $filter = true)
+    {
+        if ($filter) {
             $title = Security::remove_XSS($title);
+        }
+
         if (!empty($second_title)) {
+            if ($filter) {
                 $second_title = Security::remove_XSS($second_title);
+            }
             $title .= "<small> $second_title<small>";
         }
         return '<div class="page-header"><'.$size.'>'.$title.'</'.$size.'></div>';
     }
 
-    public static function page_header_and_translate($title, $second_title = null) {
+    public static function page_header_and_translate($title, $second_title = null)
+    {
         $title = get_lang($title);
         return self::page_header($title, $second_title);
     }
 
-     public static function page_subheader_and_translate($title, $second_title = null) {
+     public static function page_subheader_and_translate($title, $second_title = null)
+     {
         $title = get_lang($title);
         return self::page_subheader($title, $second_title);
     }
 
-    public static function page_subheader($title, $second_title = null) {
+    public static function page_subheader($title, $second_title = null)
+    {
         if (!empty($second_title)) {
             $second_title = Security::remove_XSS($second_title);
             $title .= "<small> $second_title<small>";
@@ -1505,15 +1522,18 @@ class Display
         return '<div class="page-header"><h2>'.Security::remove_XSS($title).'</h2></div>';
     }
 
-    public static function page_subheader2($title, $second_title = null) {
+    public static function page_subheader2($title, $second_title = null)
+    {
         return self::page_header($title, $second_title, 'h3');
     }
 
-    public static function page_subheader3($title, $second_title = null) {
+    public static function page_subheader3($title, $second_title = null)
+    {
         return self::page_header($title, $second_title, 'h4');
     }
 
-    public static function description($list) {
+    public static function description($list)
+    {
         $html = null;
         if (!empty($list)) {
             $html = '<dl class="dl-horizontal">';
@@ -1526,7 +1546,8 @@ class Display
         return $html;
     }
 
-    public static function bar_progress($percentage, $show_percentage = true, $extra_info = null) {
+    public static function bar_progress($percentage, $show_percentage = true, $extra_info = null)
+    {
         $percentage = intval($percentage);
         $div = '<div class="progress progress-striped">
                     <div class="bar" style="width: '.$percentage.'%;"></div>