From 05a2aa4aa106aa12b7dbca365a8f20750def7c2b Mon Sep 17 00:00:00 2001
From: emeric <itmfr@yahoo.fr>
Date: Thu, 29 Nov 2018 21:04:49 +0100
Subject: [PATCH] Properly escape user messages (fix popup error)

---
 src/ui/LmsApplication.cpp |  7 ++++++-
 src/utils/Utils.cpp       | 15 +++++++++++++++
 src/utils/Utils.hpp       |  3 +++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/ui/LmsApplication.cpp b/src/ui/LmsApplication.cpp
index 2116765e..a37e2395 100644
--- a/src/ui/LmsApplication.cpp
+++ b/src/ui/LmsApplication.cpp
@@ -537,6 +537,11 @@ LmsApplication::post(std::function<void()> func)
 	Wt::WServer::instance()->post(LmsApp->sessionId(), func);
 }
 
+static std::string escape(std::string str)
+{
+	return replaceInString(std::move(str), "\'", "\\\'");
+}
+
 void
 LmsApplication::notifyMsg(MsgType type, const Wt::WString& message, std::chrono::milliseconds duration)
 {
@@ -545,7 +550,7 @@ LmsApplication::notifyMsg(MsgType type, const Wt::WString& message, std::chrono:
 	std::ostringstream oss;
 
 	oss << "$.notify({"
-			"message: '" << message.toUTF8() << "'"
+			"message: '" << escape(message.toUTF8()) << "'"
 		"},{"
 			"type: '" << msgTypeToString(type) << "',"
 			"placement: {from: 'top', align: 'center'},"
diff --git a/src/utils/Utils.cpp b/src/utils/Utils.cpp
index f7864cb1..57704eac 100644
--- a/src/utils/Utils.cpp
+++ b/src/utils/Utils.cpp
@@ -102,3 +102,18 @@ bufferToString(const std::vector<unsigned char>& data)
 	return oss.str();
 }
 
+std::string
+replaceInString(std::string str, const std::string& from, const std::string& to)
+{
+    size_t pos = 0;
+
+    while ((pos = str.find(from, pos)) != std::string::npos)
+    {
+         str.replace(pos, from.length(), to);
+         pos += to.length();
+    }
+
+    return str;
+}
+
+
diff --git a/src/utils/Utils.hpp b/src/utils/Utils.hpp
index cba5fe91..287a62e4 100644
--- a/src/utils/Utils.hpp
+++ b/src/utils/Utils.hpp
@@ -60,3 +60,6 @@ boost::optional<T> readAs(const std::string& str)
 	return res;
 }
 
+std::string
+replaceInString(std::string str, const std::string& from, const std::string& to);
+