From 8debc870ccc47fc2b76369cfff262f0464b3d6b6 Mon Sep 17 00:00:00 2001
From: Seamus Lee <seamuslee001@gmail.com>
Date: Tue, 3 Jan 2023 12:54:11 +1100
Subject: [PATCH] CiviEvent - Escape parameters in help text

---
 CRM/Event/Form/ManageEvent.php                     |  9 +--------
 templates/CRM/Contact/Form/Search/Basic.hlp        |  4 ++--
 templates/CRM/Event/Form/ManageEvent/EventInfo.hlp |  2 +-
 templates/CRM/Event/Form/ManageEvent/Tab.hlp       | 10 ++++++----
 templates/CRM/Event/Form/ManageEvent/Tab.tpl       |  2 +-
 5 files changed, 11 insertions(+), 16 deletions(-)

diff --git a/CRM/Event/Form/ManageEvent.php b/CRM/Event/Form/ManageEvent.php
index 1de4476ef3..f630bd7ead 100644
--- a/CRM/Event/Form/ManageEvent.php
+++ b/CRM/Event/Form/ManageEvent.php
@@ -116,14 +116,7 @@ class CRM_Event_Form_ManageEvent extends CRM_Core_Form {
 
       $participantListingID = $eventInfo['participant_listing_id'] ?? NULL;
       //CRM_Core_DAO::getFieldValue( 'CRM_Event_DAO_Event', $this->_id, 'participant_listing_id' );
-      if ($participantListingID) {
-        $participantListingURL = CRM_Utils_System::url('civicrm/event/participant',
-          "reset=1&id={$this->_id}",
-          TRUE, NULL, TRUE, TRUE
-        );
-        $this->assign('participantListingURL', $participantListingURL);
-      }
-
+      $this->assign('participantListingID', $participantListingID);
       $this->assign('isOnlineRegistration', CRM_Utils_Array::value('is_online_registration', $eventInfo));
 
       $this->assign('id', $this->_id);
diff --git a/templates/CRM/Contact/Form/Search/Basic.hlp b/templates/CRM/Contact/Form/Search/Basic.hlp
index 5d84d1f7f7..9e95863300 100644
--- a/templates/CRM/Contact/Form/Search/Basic.hlp
+++ b/templates/CRM/Contact/Form/Search/Basic.hlp
@@ -20,7 +20,7 @@
   {ts}Group Search{/ts}
 {/htxt}
 {htxt id="id-smog-criteria"}
-    <p>{ts 1=$params.group_title}Contacts in the <strong>%1</strong> group are listed below.{/ts}
+    <p>{ts 1=$params.group_title|smarty:nodefaults|escape}Contacts in the <strong>%1</strong> group are listed below.{/ts}
       <ul>
         <li>{ts}Use 'Find Contacts within this Group' to search for specific contacts.{/ts}</li>
         <li>{ts}Use the 'Group Status...' checkboxes to view contacts with 'Pending' status and/or contacts who have been 'Removed' from this group.{/ts}</li>
@@ -32,7 +32,7 @@
   {ts}Add to Group{/ts}
 {/htxt}
 {htxt id="id-amtg-criteria"}
-    {ts 1=$params.group_title}Use this Search form to find contacts. Mark the contacts you want to add to this group. Then click 'Add Contacts to %1'.{/ts}
+    {ts 1=$params.group_title|smarty:nodefaults|escape}Use this Search form to find contacts. Mark the contacts you want to add to this group. Then click 'Add Contacts to %1'.{/ts}
 {/htxt}
 
 {htxt id="id-edit-smartGroup-title"}
diff --git a/templates/CRM/Event/Form/ManageEvent/EventInfo.hlp b/templates/CRM/Event/Form/ManageEvent/EventInfo.hlp
index f8b6d96f5c..5ff8c309f3 100644
--- a/templates/CRM/Event/Form/ManageEvent/EventInfo.hlp
+++ b/templates/CRM/Event/Form/ManageEvent/EventInfo.hlp
@@ -48,7 +48,7 @@
           {ts}After adding your event, create links to the listing page by copying the URL provided in the 'Participant Listing' section of the Configure Event page.{/ts}
         {/if}
       {elseif $config->userFramework EQ 'Joomla'}
-          {ts 1=$params.entityId}Then create front-end links to the Participant Listing page using the Menu Manager. Select <strong>Participant Listing Page</strong> and enter <strong>%1</strong> for the Event ID.{/ts}
+          {ts 1=$params.entityId|smarty:nodefaults|escape}Then create front-end links to the Participant Listing page using the Menu Manager. Select <strong>Participant Listing Page</strong> and enter <strong>%1</strong> for the Event ID.{/ts}
       {/if}
     {/if}
 {/htxt}
diff --git a/templates/CRM/Event/Form/ManageEvent/Tab.hlp b/templates/CRM/Event/Form/ManageEvent/Tab.hlp
index 026ceeeda1..236b66cc3f 100644
--- a/templates/CRM/Event/Form/ManageEvent/Tab.hlp
+++ b/templates/CRM/Event/Form/ManageEvent/Tab.hlp
@@ -35,12 +35,14 @@
 
 {if !$params.isTemplate}
     <tr>
-    {if $params.participantListingURL}
-        <td><a href="{$params.participantListingURL}" id="idParticipantListing"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}Participant Listing{/ts}</a></td>
+    {if $params.participantListingID}
+        {capture name=participantListingURL assign=participantListingURL}{crmURL p='civicrm/event/participant' q="reset=1&force=1&id=`$params.eventId`&status=true" a="true" fe="true"}{/capture}
+        <td><a href="{$participantListingURL}" id="idParticipantListing"><i class="crm-i fa-chevron-right" aria-hidden="true"></i>{ts}Participant Listing{/ts}</a></td>
+{*        <td><a href="{crmURL p='civicrm/event/participant' q="reset=1&force=1&id=`$params.eventId`status=true" a="true" fe="true"}" id="idParticipantListing"><i class="crm-i fa-chevron-right" aria-hidden="true"></i>{ts}Participant Listing{/ts}</a></td>*}
         {if $config->userSystem->is_drupal}
-          <td>{ts 1=$params.participantListingURL}The following URL will display a list of registered participants for this event to users whose role includes "view event participants" permission: <a href="%1">%1</a>{/ts}</td>
+          <td>{ts 1=$participantListingURL}The following URL will display a list of registered participants for this event to users whose role includes "view event participants" permission: <a href="%1">%1</a>{/ts}</td>
         {else}
-          <td>{ts 1=$params.participantListingURL}The following URL will display a list of registered participants for this event: <a href="%1">%1</a>{/ts}</td>
+          <td>{ts 1=$participantListingURL}The following URL will display a list of registered participants for this event: <a href="%1">%1</a>{/ts}</td>
         {/if}
     {else}
         <td><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}Participant Listing{/ts}</td>
diff --git a/templates/CRM/Event/Form/ManageEvent/Tab.tpl b/templates/CRM/Event/Form/ManageEvent/Tab.tpl
index 8f75a54441..55f9fe03bd 100644
--- a/templates/CRM/Event/Form/ManageEvent/Tab.tpl
+++ b/templates/CRM/Event/Form/ManageEvent/Tab.tpl
@@ -48,7 +48,7 @@
         </div></li>
 
       <li><div>
-          {help id="id-configure-events" isTemplate=$isTemplate participantListingURL=$participantListingURL isOnlineRegistration=$isOnlineRegistration eventId=$id}
+          {help id="id-configure-events" isTemplate=$isTemplate participantListingID=$participantListingID isOnlineRegistration=$isOnlineRegistration eventId=$id}
       </div></li>
       </ul>
       <div class="clear"></div>
-- 
2.25.1