Properly escape user messages (fix popup error)

src/ui/LmsApplication.cpp

@@ -537,6 +537,11 @@ LmsApplication::post(std::function<void()> func)
 	Wt::WServer::instance()->post(LmsApp->sessionId(), func);
 }
 
+static std::string escape(std::string str)
+{
+	return replaceInString(std::move(str), "\'", "\\\'");
+}
+
 void
 LmsApplication::notifyMsg(MsgType type, const Wt::WString& message, std::chrono::milliseconds duration)
 {
@@ -545,7 +550,7 @@ LmsApplication::notifyMsg(MsgType type, const Wt::WString& message, std::chrono:
 	std::ostringstream oss;
 
 	oss << "$.notify({"
-			"message: '" << message.toUTF8() << "'"
+			"message: '" << escape(message.toUTF8()) << "'"
 		"},{"
 			"type: '" << msgTypeToString(type) << "',"
 			"placement: {from: 'top', align: 'center'},"

src/utils/Utils.cpp

@@ -102,3 +102,18 @@ bufferToString(const std::vector<unsigned char>& data)
 	return oss.str();
 }
 
+std::string
+replaceInString(std::string str, const std::string& from, const std::string& to)
+{
+    size_t pos = 0;
+
+    while ((pos = str.find(from, pos)) != std::string::npos)
+    {
+         str.replace(pos, from.length(), to);
+         pos += to.length();
+    }
+
+    return str;
+}
+
+

src/utils/Utils.hpp

@@ -60,3 +60,6 @@ boost::optional<T> readAs(const std::string& str)
 	return res;
 }
 
+std::string
+replaceInString(std::string str, const std::string& from, const std::string& to);
+