Procházet zdrojové kódy

[svn r13294] Fix encoding problem by using $charset inside calls to htmlentities() and htmlspecialchars

Yannick Warnier před 17 roky
rodič
revize
33b87d2fc8

+ 2 - 2
main/announcements/announcements.php

@@ -1,4 +1,4 @@
-<?php //$Id: announcements.php 13270 2007-09-26 08:30:54Z elixir_julian $
+<?php //$Id: announcements.php 13294 2007-09-27 02:14:48Z yannoo $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -1376,7 +1376,7 @@ if ($message == true)
 							"</a></td>";
 
 
-					if (api_is_allowed_to_edit()) echo "<td valign=\"top\"><a href=\"".api_get_self()."?".api_get_cidreq()."&action=delete&id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang('ConfirmYourChoice')))."')) return false;\">",
+					if (api_is_allowed_to_edit()) echo "<td valign=\"top\"><a href=\"".api_get_self()."?".api_get_cidreq()."&action=delete&id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang('ConfirmYourChoice'),ENT_QUOTES,$charset))."')) return false;\">",
 							"<img src=\"../img/delete.gif\" title=\"",get_lang('Delete'),"\" border=\"0\" align=\"absmiddle\">",
 							"</a></td>";
 

+ 5 - 5
main/calendar/agenda.inc.php

@@ -1,4 +1,4 @@
-<?php //$Id: agenda.inc.php 13071 2007-09-18 09:52:41Z elixir_julian $
+<?php //$Id: agenda.inc.php 13294 2007-09-27 02:14:48Z yannoo $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -1259,7 +1259,7 @@ function display_agenda_items()
 	global $select_month, $select_year;
 	global $DaysShort, $DaysLong, $MonthsLong;
 	global $is_courseAdmin;
-	global $dateFormatLong, $timeNoSecFormat;
+	global $dateFormatLong, $timeNoSecFormat,$charset;
 	global $_user;
 
 	// getting the group memberships
@@ -1569,7 +1569,7 @@ function display_agenda_items()
 		// edit
 		echo 	"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=edit&amp;id=".$myrow['id']."\">",
 				"<img src=\"../img/edit.gif\" border=\"0\" alt=\"".get_lang("ModifyCalendarItem")."\" /></a>",
-				"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=delete&amp;id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."')) return false;\">",
+				"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=delete&amp;id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."')) return false;\">",
 				"<img src=\"../img/delete.gif\" border=\"0\" alt=\"".get_lang("Delete")."\"/></a>";
 		echo 	"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=announce&amp;id=".$myrow['id']."\">".
 				"<img src=\"../img/announce_add.gif\" border=\"0\" alt=\"".get_lang("AddAnnouncement")."\"/></a>";
@@ -1624,7 +1624,7 @@ function display_one_agenda_item($agenda_id)
 	global $select_month, $select_year;
 	global $DaysShort, $DaysLong, $MonthsLong;
 	global $is_courseAdmin;
-	global $dateFormatLong, $timeNoSecFormat;
+	global $dateFormatLong, $timeNoSecFormat, $charset;
 	global $_user;
 	//echo "displaying agenda items";
 
@@ -1764,7 +1764,7 @@ function display_one_agenda_item($agenda_id)
 		// edit
 		echo 	"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=edit&amp;id=".$myrow['id']."\">",
 				"<img src=\"../img/edit.gif\" border=\"0\" alt=\"".get_lang("ModifyCalendarItem")."\" /></a>",
-				"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=delete&amp;id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."')) return false;\">",
+				"<a href=\"".api_get_self()."?".api_get_cidreq()."&origin=".$_GET['origin']."&amp;action=delete&amp;id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."')) return false;\">",
 				"<img src=\"../img/delete.gif\" border=\"0\" alt=\"".get_lang("Delete")."\" /></a>";
 		if ($myrow['visibility']==1)
 			{

+ 3 - 3
main/calendar/myagenda.php

@@ -74,7 +74,7 @@ $nameTools = get_lang('MyAgenda');
 
 // if we come from inside a course and click on the 'My Agenda' link we show a link back to the course
 // in the breadcrumbs
-$course_path = htmlentities(strip_tags($_GET['coursePath']));
+$course_path = htmlentities(strip_tags($_GET['coursePath']),ENT_QUOTES,$charset);
 if (!empty ($course_path))
 {
 	$interbreadcrumb[] = array ('url' => api_get_path(WEB_COURSE_PATH).urlencode($course_path).'/index.php', 'name' => $_GET['courseCode']);
@@ -1250,7 +1250,7 @@ function get_personal_agendaitems($agendaitems, $day = "", $month = "", $year =
 function show_personal_agenda()
 {
 	global $tbl_personal_agenda;
-	global $MonthsLong;
+	global $MonthsLong, $charset;
 	global $_user;
 	// The SQL statement that retrieves all the personal agenda items of this user
 	$sql = "SELECT * FROM ".$tbl_personal_agenda." WHERE user='".$_user['user_id']."' ORDER BY date DESC";
@@ -1322,7 +1322,7 @@ function show_personal_agenda()
 			  --------------------------------------------------*/
 			echo "\t<tr>\n\t\t<td class=\"".$text_style."\" colspan='2'>";
 			echo "<a href=\"myagenda.php?action=edit_personal_agenda_item&amp;id=".$myrow['id']."\"><img src=\"../img/edit.gif\" border=\"0\" alt=\"".get_lang('Edit')."\" /></a>";
-			echo "<a href=\"".api_get_self()."?action=delete&amp;id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang('ConfirmYourChoice')))."')) return false;\"><img src=\"../img/delete.gif\" border=\"0\" alt=\"".get_lang('Delete')."\" /></a>";
+			echo "<a href=\"".api_get_self()."?action=delete&amp;id=".$myrow['id']."\" onclick=\"javascript:if(!confirm('".addslashes(htmlentities(get_lang('ConfirmYourChoice'),ENT_QUOTES,$charset))."')) return false;\"><img src=\"../img/delete.gif\" border=\"0\" alt=\"".get_lang('Delete')."\" /></a>";
 			echo "</td></tr>";
 		}
 	}

+ 2 - 2
main/calendar/print.php

@@ -37,7 +37,7 @@ $result			= api_sql_query($sql,__FILE__,__LINE__);
 <body style="margin: 15px; padding: 0px;">
 
 <center>
-<input type="button" value="<?php echo htmlentities(get_lang('Print')); ?>" onClick="javascript:window.print();" />
+<input type="button" value="<?php echo htmlentities(get_lang('Print'),ENT_QUOTES,$charset); ?>" onClick="javascript:window.print();" />
 </center>
 <br /><br />
 
@@ -74,7 +74,7 @@ while($row=mysql_fetch_array($result))
 
 <br /><br />
 <center>
-<input type="button" value="<?php echo htmlentities(get_lang('Print')); ?>" onClick="javascript:window.print();" />
+<input type="button" value="<?php echo htmlentities(get_lang('Print'),ENT_QUOTES,$charset); ?>" onClick="javascript:window.print();" />
 </center>
 
 </body>

+ 1 - 1
main/chat/chat_chat.php

@@ -146,7 +146,7 @@ if($isMaster || $is_courseCoach)
 	$rand=mt_rand(1,1000);
 	
 	echo '<div style="margin-left: 5px;">';
-	echo '<a href="'.api_get_self().'?rand='.$rand.'&reset=1#bottom" onclick="javascript:if(!confirm(\''.addslashes(htmlentities(get_lang('ConfirmReset'))).'\')) return false;"><img src="../img/delete.gif" border="0" alt="" align="absbottom">'.get_lang('ClearList').'</a>';
+	echo '<a href="'.api_get_self().'?rand='.$rand.'&reset=1#bottom" onclick="javascript:if(!confirm(\''.addslashes(htmlentities(get_lang('ConfirmReset'),ENT_QUOTES,$charset)).'\')) return false;"><img src="../img/delete.gif" border="0" alt="" align="absbottom">'.get_lang('ClearList').'</a>';
 	echo '</div>';	
 }
 

+ 2 - 2
main/chat/chat_message.php

@@ -99,7 +99,7 @@ $chat_size=0;
 
 if($sent)
 {
-	$message=trim(htmlspecialchars(stripslashes($_POST['message'])));
+	$message=trim(htmlspecialchars(stripslashes($_POST['message']),ENT_QUOTES,$charset));
 	
 	if(!empty($message))
 	{
@@ -140,7 +140,7 @@ if($sent)
 include('header_frame.inc.php');
 ?>
 
-<form name="formMessage" method="post" action="<?php echo api_get_self(); ?>" onsubmit="javascript:if(document.formMessage.message.value == '') { alert('<?php echo addslashes(htmlentities(get_lang('TypeMessage'))); ?>'); document.formMessage.message.focus(); return false; }" autocomplete="off">
+<form name="formMessage" method="post" action="<?php echo api_get_self(); ?>" onsubmit="javascript:if(document.formMessage.message.value == '') { alert('<?php echo addslashes(htmlentities(get_lang('TypeMessage'),ENT_QUOTES,$charset)); ?>'); document.formMessage.message.focus(); return false; }" autocomplete="off">
 <input type="hidden" name="sent" value="1">
 <table border="0" cellpadding="5" cellspacing="0" width="100%">
 <tr>

+ 2 - 2
main/course_description/index.php

@@ -1,4 +1,4 @@
-<?php // $Id: index.php 12761 2007-07-20 09:17:11Z elixir_julian $
+<?php // $Id: index.php 13294 2007-09-27 02:14:48Z yannoo $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -299,7 +299,7 @@ if ($show_description_list)
 			echo '<div>';
 			if (api_is_allowed_to_edit())
 			{
-				echo '<a href="'.api_get_self().'?action=delete&amp;description_id='.$description->id.'" onclick="javascript:if(!confirm(\''.addslashes(htmlentities(get_lang('ConfirmYourChoice'))).'\')) return false;">';
+				echo '<a href="'.api_get_self().'?action=delete&amp;description_id='.$description->id.'" onclick="javascript:if(!confirm(\''.addslashes(htmlentities(get_lang('ConfirmYourChoice'),ENT_QUOTES,$charset)).'\')) return false;">';
 				echo '<img src="../img/delete.gif" alt="'.get_lang("Delete").'" border="0" style="vertical-align:middle;float:right;margin:2px;" />';
 				echo '</a> ';
 			}

+ 2 - 1
main/course_home/2column.php

@@ -52,6 +52,7 @@
  */
 function show_tools($course_tool_category)
 {
+	global $charset;
 	$web_code_path = api_get_path(WEB_CODE_PATH);
 	$course_tool_table = Database::get_course_table(TABLE_TOOL_LIST);
 
@@ -158,7 +159,7 @@ function show_tools($course_tool_category)
 						'" target="' , $toolsRow['target'], '" '.$class.'>',
 					'<img src="', $web_code_path, 'img/',
 						$toolsRow['image'], '" align="absmiddle" border="0" alt="', $toolsRow['image'],'" />',
-					'&nbsp;', ($toolsRow['image']=="external.gif" || $toolsRow['image']=="external_na.gif" || $toolsRow['image']=="scormbuilder.gif" || $toolsRow['image']=="blog.gif") ? htmlspecialchars( $toolsRow['name']) : get_lang(ucfirst($toolsRow['name'])),
+					'&nbsp;', ($toolsRow['image']=="external.gif" || $toolsRow['image']=="external_na.gif" || $toolsRow['image']=="scormbuilder.gif" || $toolsRow['image']=="blog.gif") ? htmlspecialchars( $toolsRow['name'],ENT_QUOTES,$charset) : get_lang(ucfirst($toolsRow['name'])),
 					"</a>\n ";
 
 			// This part displays the links to hide or remove a tool.

+ 1 - 1
main/course_home/3column.php

@@ -90,7 +90,7 @@ if (is_allowed_to_edit())
 		$sql = "SELECT * FROM $TBL_ACCUEIL WHERE id=$id";
 		$result = api_sql_query($sql,__FILE__,__LINE__);
 		$toolsRow = mysql_fetch_array($result);
-		$tool_name = htmlspecialchars($toolsRow['name'] != "" ? $toolsRow['name'] : $toolsRow['link']);
+		$tool_name = htmlspecialchars($toolsRow['name'] != "" ? $toolsRow['name'] : $toolsRow['link'],ENT_QUOTES,$charset);
 		if($toolsRow['img'] != "external.gif")
 		{
 			$toolsRow['link']=$clarolineRepositoryWeb.$toolsRow['link'];

+ 3 - 3
main/course_home/btf_functions.php

@@ -1,5 +1,5 @@
 <?php
-// $Id: btf_functions.php 12263 2007-05-03 13:34:40Z elixir_julian $
+// $Id: btf_functions.php 13294 2007-09-27 02:14:48Z yannoo $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -41,7 +41,7 @@
 
 function showtools2($cat)
 {
-	GLOBAL $_user;
+	global $_user, $charset;
 
 	$TBL_ACCUEIL = Database :: get_course_table(TABLE_TOOL_LIST);
 	$TABLE_TOOLS = Database :: get_main_table(TABLE_MAIN_COURSE_MODULE);
@@ -137,7 +137,7 @@ function showtools2($cat)
 	{
 		$cell_content = '';
 		// the name of the tool
-		$tool_name = ($toolsRow['name_translated'] != "" ? $toolsRow['name_translated'] : htmlspecialchars($toolsRow['name'])); // RH: added htmlspecialchars
+		$tool_name = ($toolsRow['name_translated'] != "" ? $toolsRow['name_translated'] : htmlspecialchars($toolsRow['name'],ENT_QUOTES,$charset)); // RH: added htmlspecialchars
 
 		$link_annex = '';
 		// the url of the tool

+ 2 - 2
main/document/document.php

@@ -1,4 +1,4 @@
-<?php // $Id: document.php 12718 2007-07-09 12:04:18Z elixir_inter $
+<?php // $Id: document.php 13294 2007-09-27 02:14:48Z yannoo $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -548,7 +548,7 @@ if($docs_and_folders)
 		//icons
 		$row[]= build_document_icon_tag($id['filetype'],$id['path']);
 		//document title with hyperlink
-		$row[] = create_document_link($http_www,$document_name,$id['path'],$id['filetype'],$size,$id['visibility']).'<br />'.$invisibility_span_open.nl2br(htmlspecialchars($id['comment'])).$invisibility_span_close;
+		$row[] = create_document_link($http_www,$document_name,$id['path'],$id['filetype'],$size,$id['visibility']).'<br />'.$invisibility_span_open.nl2br(htmlspecialchars($id['comment'],ENT_QUOTES,$charset)).$invisibility_span_close;
 		//comments => display comment under the document name
 		//$row[] = $invisibility_span_open.nl2br(htmlspecialchars($id['comment'])).$invisibility_span_close;
 		$display_size = format_file_size($size);

+ 7 - 7
main/dropbox/dropbox_submit.php

@@ -330,7 +330,7 @@ if ( isset( $_GET['mailingIndex']))  // examine or send
     $mailing_file = dropbox_cnf("sysPath") . '/' . $mailing_item->filename;
     $errormsg = '<b>' . $mailing_item->recipients[0]['name'] . ' ('
     	. "<a href='dropbox_download.php?origin=$origin&id=".urlencode($mailing_item->id)."'>"
-		. htmlspecialchars($mailing_title) . '</a>):</b><br><br>';
+		. htmlspecialchars($mailing_title,ENT_QUOTES,$charset) . '</a>):</b><br><br>';
 
     if ( preg_match( dropbox_cnf("mailingZipRegexp"), $mailing_title, $nameParts))
 	{
@@ -452,11 +452,11 @@ if ( isset( $_GET['mailingIndex']))  // examine or send
 
 			foreach( $goodFiles as $thisFile => $thisRecip)
 			{
-				$errormsg .= htmlspecialchars($thisFile) . ': ';
+				$errormsg .= htmlspecialchars($thisFile,ENT_QUOTES,$charset) . ': ';
 	            if ( is_string($thisRecip))  // see findRecipient
 	            {
 					$errormsg .= '<font color="#FF0000">'
-						. htmlspecialchars($thisRecip) . '</font><br>';
+						. htmlspecialchars($thisRecip,ENT_QUOTES,$charset) . '</font><br>';
 	            }
 	            else
 	            {
@@ -468,7 +468,7 @@ if ( isset( $_GET['mailingIndex']))  // examine or send
 		            {
 						$errormsg .= dropbox_lang("mailingFileIsFor");
 		            }
-					$errormsg .= htmlspecialchars($thisRecip[1].' '.$thisRecip[2]);
+					$errormsg .= htmlspecialchars($thisRecip[1].' '.$thisRecip[2],ENT_QUOTES,$charset);
 
 					if ( is_null($thisRecip[3]))
 					{
@@ -499,7 +499,7 @@ if ( isset( $_GET['mailingIndex']))  // examine or send
 		        $remainingUsers = '';
 		        while ( ($res = mysql_fetch_array($result)))
 		        {
-					$remainingUsers .= ', ' . htmlspecialchars($res[0].' '.$res[1]);
+					$remainingUsers .= ', ' . htmlspecialchars($res[0].' '.$res[1],ENT_QUOTES,$charset);
 		        }
 		        $errormsg .= '<br>' . dropbox_lang("mailingNothingFor") . substr($remainingUsers, 1) . '.<br>';
 	        }
@@ -657,7 +657,7 @@ if ( isset( $_GET['deleteReceived']) || isset( $_GET['deleteSent'])
     	{
         	krsort($fbarray);
             echo '<textarea class="dropbox_feedbacks">',
-                    htmlspecialchars(implode("\n\n", $fbarray)), '</textarea>', "\n";
+                    htmlspecialchars(implode("\n\n", $fbarray),ENT_QUOTES,$charset), '</textarea>', "\n";
         }
         else
         {
@@ -680,7 +680,7 @@ if ( isset( $_GET['deleteReceived']) || isset( $_GET['deleteSent'])
             '<input type="hidden" name="feedbackid" value="',
                 $id, '"/>', "\n",
             '<textarea name="feedbacktext" class="dropbox_feedbacks">',
-                htmlspecialchars($w->feedback), '</textarea>', "<br>\n",
+                htmlspecialchars($w->feedback,ENT_QUOTES,$charset), '</textarea>', "<br>\n",
             '<input type="submit" name="feedbacksubmit" value="', dropbox_lang("ok", "noDLTT"), '"/>', "\n",
             '</form>', "\n";
         $tellUser = dropbox_lang("giveFeedback");

+ 1 - 1
main/external_module/external_module.php

@@ -164,7 +164,7 @@ if(!empty($msgErr))
 </tr>
 <tr>
   <td align="right"><?php echo get_lang('Name'); ?> :</td>
-  <td><input type="text" name="name_link" size="50" value="<?php if($_POST['formSent']) echo htmlentities($name_link); else echo $toolid ? htmlspecialchars($row['name']) : ''; ?>"></td>
+  <td><input type="text" name="name_link" size="50" value="<?php if($_POST['formSent']) echo htmlentities($name_link,ENT_QUOTES,$charset); else echo $toolid ? htmlspecialchars($row['name'],ENT_QUOTES,$charset) : ''; ?>"></td>
 </tr>
 <tr>
   <td align="right"><?php echo get_lang('LinkTarget'); ?> :</td>

+ 6 - 6
main/group/group.php

@@ -223,7 +223,7 @@ foreach ($group_cats as $index => $category)
 		if (api_is_allowed_to_edit())
 		{
 			echo '<a href="group_category.php?'.api_get_cidreq().'&id='.$category['id'].'"  title="'.get_lang('Edit').'"><img src="../img/edit.gif" alt="'.get_lang('Edit').'"/></a> ';
-			echo '<a href="group.php?'.api_get_cidreq().'&action=delete_category&amp;id='.$category['id'].'"  onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;" title="'.get_lang('Delete').'"><img src="../img/delete.gif"  alt="'.get_lang('Delete').'"/></a> ';
+			echo '<a href="group.php?'.api_get_cidreq().'&action=delete_category&amp;id='.$category['id'].'"  onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;" title="'.get_lang('Delete').'"><img src="../img/delete.gif"  alt="'.get_lang('Delete').'"/></a> ';
 			if ($index != 0)
 			{
 				echo ' <a href="group.php?'.api_get_cidreq().'&action=swap_cat_order&amp;id1='.$category['id'].'&amp;id2='.$group_cats[$index -1]['id'].'"><img src="../img/up.gif" alt=""/></a>';
@@ -284,11 +284,11 @@ foreach ($group_cats as $index => $category)
 			{
 				if (GroupManager :: is_self_registration_allowed($_user['user_id'], $this_group['id']))
 				{
-					$row[] = '<a href="group.php?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=self_reg&amp;group_id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.get_lang("GroupSelfRegInf").'</a>';
+					$row[] = '<a href="group.php?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=self_reg&amp;group_id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.get_lang("GroupSelfRegInf").'</a>';
 				}
 				elseif (GroupManager :: is_self_unregistration_allowed($_user['user_id'], $this_group['id']))
 				{
-					$row[] = '<a href="group.php?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=self_unreg&amp;group_id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.get_lang("GroupSelfUnRegInf").'</a>';
+					$row[] = '<a href="group.php?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=self_unreg&amp;group_id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.get_lang("GroupSelfUnRegInf").'</a>';
 				}
 				else
 				{
@@ -315,9 +315,9 @@ foreach ($group_cats as $index => $category)
 			if (api_is_allowed_to_edit())
 			{
 				$edit_actions = '<a href="group_edit.php?'.api_get_cidreq().'&gidReq='.$this_group['id'].'"  title="'.get_lang('Edit').'"><img src="../img/edit.gif" alt="'.get_lang("Edit").'"/></a>&nbsp;';
-				$edit_actions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=delete_one&amp;id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;" title="'.get_lang('Delete').'"><img src="../img/delete.gif" alt="'.get_lang("Delete").'"/></a>&nbsp;';
-				$edit_actions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=empty_one&amp;id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;" title="'.get_lang('EmptyGroup').'"><img src="../img/group_delete.gif" alt="'.get_lang("EmptyGroup").'"/></a>&nbsp;';
-				$edit_actions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=fill_one&amp;id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;" title="'.get_lang('FillGroup').'"><img src="../img/add_user.gif" alt="'.get_lang("FillGroup").'"/></a>';
+				$edit_actions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=delete_one&amp;id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;" title="'.get_lang('Delete').'"><img src="../img/delete.gif" alt="'.get_lang("Delete").'"/></a>&nbsp;';
+				$edit_actions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=empty_one&amp;id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;" title="'.get_lang('EmptyGroup').'"><img src="../img/group_delete.gif" alt="'.get_lang("EmptyGroup").'"/></a>&nbsp;';
+				$edit_actions .= '<a href="'.api_get_self().'?'.api_get_cidreq().'&category='.$category['id'].'&amp;action=fill_one&amp;id='.$this_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;" title="'.get_lang('FillGroup').'"><img src="../img/add_user.gif" alt="'.get_lang("FillGroup").'"/></a>';
 				$row[] = $edit_actions;
 			}
 			$totalRegistered = $totalRegistered + $this_group[nbMember];

+ 2 - 2
main/group/group_space.php

@@ -102,7 +102,7 @@ if (api_is_allowed_to_edit() or GroupManager :: is_tutor($_user['user_id']))
  */
 if (GroupManager :: is_self_registration_allowed($_SESSION['_user']['user_id'], $current_group['id']))
 {
-	echo '<p align="right"><a href="'.api_get_self().'?selfReg=1&amp;group_id='.$current_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.get_lang("RegIntoGroup").'</a></p>';
+	echo '<p align="right"><a href="'.api_get_self().'?selfReg=1&amp;group_id='.$current_group['id'].'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.get_lang("RegIntoGroup").'</a></p>';
 }
 
 /*
@@ -110,7 +110,7 @@ if (GroupManager :: is_self_registration_allowed($_SESSION['_user']['user_id'],
  */
 if (GroupManager :: is_self_unregistration_allowed($_SESSION['_user']['user_id'], $current_group['id']))
 {
-	echo '<p align="right"><a href="'.api_get_self().'?selfUnReg=1" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.get_lang("StudentUnsubscribe").'</a></p>';
+	echo '<p align="right"><a href="'.api_get_self().'?selfUnReg=1" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.get_lang("StudentUnsubscribe").'</a></p>';
 }
 
 if( isset($_GET['action']))