Merge pull request #31922 from colemanw/escapeRoom

#5711 Smarty - Escape all translated html attributes

ext/civigrant/templates/CRM/Grant/Form/Selector.tpl

@@ -16,7 +16,7 @@
   <thead class="sticky">
   <tr>
   {if ! $single and $context eq 'Search'}
-     <th scope="col" title="{ts}Select rows{/ts}">{$form.toggleSelect.html}</th>
+     <th scope="col" title="{ts escape='htmlattribute'}Select rows{/ts}">{$form.toggleSelect.html}</th>
   {/if}
   {foreach from=$columnHeaders item=header}
     <th scope="col">

ext/ckeditor4/templates/CRM/Ckeditor4/Form/CKEditorConfig.tpl

@@ -71,7 +71,7 @@
       </select>
       &nbsp;&nbsp;
       <label for="extraPlugins">{ts}Plugins{/ts}</label>
-      <input id="extraPlugins" name="config_extraPlugins" class="huge config-param" value="{$extraPlugins}" placeholder="{ts}Select optional extra features{/ts}">
+      <input id="extraPlugins" name="config_extraPlugins" class="huge config-param" value="{$extraPlugins}" placeholder="{ts escape='htmlattribute'}Select optional extra features{/ts}">
     </div>
 
     <div class="editors-container">
@@ -98,6 +98,6 @@
 </div>
 <script type="text/template" id="config-row-tpl">
   <div class="crm-config-option-row">
-    <input class="huge crm-config-option-name" placeholder="{ts}Option{/ts}"/>
+    <input class="huge crm-config-option-name" placeholder="{ts escape='htmlattribute'}Option{/ts}"/>
   </div>
 </script>

ext/eventcart/templates/CRM/Event/Cart/Form/Checkout/ParticipantsAndPrices.tpl

@@ -2,7 +2,7 @@
 
   {if $contact}
     <div class="messages status no-popup">
-      {ts 1=$contact.display_name}Welcome %1{/ts}. (<a href="{crmURL p='civicrm/event/cart_checkout' q="cid=0&reset=1"}" title="{ts}Click here to register a different person for this event.{/ts}">{ts 1=$contact.display_name}Not %1, or want to register a different person{/ts}</a>?)</div>
+      {ts 1=$contact.display_name}Welcome %1{/ts}. (<a href="{crmURL p='civicrm/event/cart_checkout' q="cid=0&reset=1"}" title="{ts escape='htmlattribute'}Click here to register a different person for this event.{/ts}">{ts 1=$contact.display_name}Not %1, or want to register a different person{/ts}</a>?)</div>
   {/if}
 
   {foreach from=$events_in_carts key=index item=event_in_cart}

ext/eventcart/templates/CRM/Event/Cart/Page/ViewCart.tpl

@@ -20,7 +20,7 @@
         {if !$event_in_cart.main_conference_event_id}
           <tr>
             <td>
-              <a href="{crmURL p='civicrm/event/info' q="reset=1&id=`$event_in_cart.event.id`"}" title="{ts}View event info page{/ts}" class="bold">{$event_in_cart.event.title}</a>
+              <a href="{crmURL p='civicrm/event/info' q="reset=1&id=`$event_in_cart.event.id`"}" title="{ts escape='htmlattribute'}View event info page{/ts}" class="bold">{$event_in_cart.event.title}</a>
             </td>
             <td>
               <a title="Remove From Cart" class="action-item" href="{crmURL p='civicrm/event/remove_from_cart' q="reset=1&id=`$event_in_cart.event.id`"}">{ts}Remove{/ts}</a>

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom.tpl

@@ -59,7 +59,7 @@
         {/if}
 
         {strip}
-        <table class="selector row-highlight" summary="{ts}Search results listings.{/ts}">
+        <table class="selector row-highlight" summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
             <thead class="sticky">
                 <tr>
                 <th scope="col" title="Select All Rows">{$form.toggleSelect.html}</th>

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/ActivitySearch.tpl

@@ -56,7 +56,7 @@
           {include file="CRM/common/pagerAToZ.tpl"}
 
           {strip}
-            <table summary="{ts}Search results listings.{/ts}">
+            <table summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
               <thead class="sticky">
                 <th scope="col" title="Select All Rows">{$form.toggleSelect.html}</th>
                 {foreach from=$columnHeaders item=header}
@@ -88,9 +88,9 @@
                       {elseif $fName eq 'activity_subject'}
                          <td>
                            {if $row.case_id}
-                              <a href="{crmURL p='civicrm/case/activity/view' q="reset=1&aid=`$row.activity_id`&cid=`$row.contact_id`&caseID=`$row.case_id`"}" title="{ts}View activity details{/ts}">
+                              <a href="{crmURL p='civicrm/case/activity/view' q="reset=1&aid=`$row.activity_id`&cid=`$row.contact_id`&caseID=`$row.case_id`"}" title="{ts escape='htmlattribute'}View activity details{/ts}">
                            {else}
-                              <a href="{crmURL p='civicrm/contact/view/activity' q="atype=`$row.activity_type_id`&action=view&reset=1&id=`$row.activity_id`&cid=`$row.contact_id`"}" title="{ts}View activity details{/ts}">
+                              <a href="{crmURL p='civicrm/contact/view/activity' q="atype=`$row.activity_type_id`&action=view&reset=1&id=`$row.activity_id`&cid=`$row.contact_id`"}" title="{ts escape='htmlattribute'}View activity details{/ts}">
                            {/if}
                            {if isset($row.activity_subject) AND $row.activity_subject NEQ 'NULL'}{$row.activity_subject}{else}{ts}(no subject){/ts}{/if}</a>
                          </td>

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/ContribSYBNT.tpl

@@ -88,7 +88,7 @@
         {/if}
 
         {strip}
-        <table class="selector row-highlight" summary="{ts}Search results listings.{/ts}">
+        <table class="selector row-highlight" summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
             <thead class="sticky">
                 <th scope="col" title="Select All Rows">{$form.toggleSelect.html}</th>
                 {foreach from=$columnHeaders item=header}

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/ContributionAggregate.tpl

@@ -68,7 +68,7 @@
         {/if}
 
         {strip}
-        <table class="selector row-highlight" summary="{ts}Search results listings.{/ts}">
+        <table class="selector row-highlight" summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
             <thead class="sticky">
                 <tr>
                 <th scope="col" title="Select All Rows">{$form.toggleSelect.html}</th>

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/EventDetails.tpl

@@ -65,7 +65,7 @@
         {include file="CRM/common/pagerAToZ.tpl"}
 
         {strip}
-        <table summary="{ts}Search results listings.{/ts}">
+        <table summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
             <thead class="sticky">
                 {foreach from=$columnHeaders item=header}
                     <th scope="col">

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/FullText.tpl

@@ -44,7 +44,7 @@
       : {if !$table}{if $summary.Count.Contact <= $limit}{$summary.Count.Contact}{else}{ts 1=$limit}%1 or more{/ts}{/if}{else}{$summary.Count.Contact}{/if}</h3>
     {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
     {* This section displays the rows along and includes the paging controls *}
-      <table id="contact_listing" class="display" class="selector" summary="{ts}Contact listings.{/ts}">
+      <table id="contact_listing" class="display" class="selector" summary="{ts escape='htmlattribute'}Contact listings.{/ts}">
         <thead>
         <tr>
           <th class='link'>{ts}Name{/ts}</th>
@@ -56,7 +56,7 @@
           <tr class="{cycle values="odd-row,even-row"}">
             <td><a
                 href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.sort_name}</a></td>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.sort_name}</a></td>
             {if $allowFileSearch}<td>{$row.fileHtml}</td>{/if}
             <td><a
                 href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}">{ts}View{/ts}</a>
@@ -67,7 +67,7 @@
     {if !$table and $summary.addShowAllLink.Contact}
       <div class="crm-section full-text-view-all-section">
         <a href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=Contact&text=$text"}"
-        title="{ts}View all results for contacts{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for contacts{/ts}</a>
+        title="{ts escape='htmlattribute'}View all results for contacts{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for contacts{/ts}</a>
       </div>{/if}
     {* note we using location="below" because we don't want to use rows per page for now. And therefore don't put location="bottom" for now. *}
     {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
@@ -83,7 +83,7 @@
       : {if !$table}{if $summary.Count.Activity <= $limit}{$summary.Count.Activity}{else}{ts 1=$limit}%1 or more{/ts}{/if}{else}{$summary.Count.Activity}{/if}</h3>
     {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
     {* This section displays the rows along and includes the paging controls *}
-      <table id="activity_listing" class="display" summary="{ts}Activity listings.{/ts}">
+      <table id="activity_listing" class="display" summary="{ts escape='htmlattribute'}Activity listings.{/ts}">
         <thead>
         <tr>
           <th>{ts}Type{/ts}</th>
@@ -103,15 +103,15 @@
             <td>{$row.details|escape}</td>
             <td>
               <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.sort_name}</a>
             </td>
             <td>
               <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.target_contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.target_sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.target_sort_name}</a>
             </td>
             <td>
               <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.assignee_contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.assignee_sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.assignee_sort_name}</a>
             </td>
             {if $allowFileSearch}<td>{$row.fileHtml}</td>{/if}
             <td>
@@ -130,7 +130,7 @@
     {if !$table and $summary.addShowAllLink.Activity}
       <div class="crm-section full-text-view-all-section">
         <a href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=Activity&text=$text"}"
-        title="{ts}View all results for activities{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for activities{/ts}</a>
+        title="{ts escape='htmlattribute'}View all results for activities{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for activities{/ts}</a>
       </div>
     {/if}
     {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
@@ -145,7 +145,7 @@
       : {if !$table}{if $summary.Count.Case <= $limit}{$summary.Count.Case}{else}{ts 1=$limit}%1 or more{/ts}{/if}{else}{$summary.Count.Case}{/if}</h3>
     {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
     {* This section displays the rows along and includes the paging controls *}
-      <table id="case_listing" class="display" summary="{ts}Case listings.{/ts}">
+      <table id="case_listing" class="display" summary="{ts escape='htmlattribute'}Case listings.{/ts}">
         <thead>
         <tr>
           <th class='link'>{ts}Client Name{/ts}</th>
@@ -162,7 +162,7 @@
           <tr class="{cycle values="odd-row,even-row"}">
             <td>
               <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.sort_name}</a>
             </td>
             <td>{$row.case_start_date|crmDate:"%b %d, %Y %l:%M %P"}</td>
             <td>{$row.case_end_date|crmDate:"%b %d, %Y %l:%M %P"}</td>
@@ -187,7 +187,7 @@
     {if !$table and $summary.addShowAllLink.Case}
       <div class="crm-section full-text-view-all-section">
         <a href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=Case&text=$text"}"
-        title="{ts}View all results for cases{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for cases{/ts}</a>
+        title="{ts escape='htmlattribute'}View all results for cases{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for cases{/ts}</a>
       </div>
     {/if}
     {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
@@ -203,7 +203,7 @@
       : {if !$table}{if $summary.Count.Contribution <= $limit}{$summary.Count.Contribution}{else}{ts 1=$limit}%1 or more{/ts}{/if}{else}{$summary.Count.Contribution}{/if}</h3>
     {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
     {* This section displays the rows along and includes the paging controls *}
-      <table id="contribute_listing" class="display" summary="{ts}Contribution listings.{/ts}">
+      <table id="contribute_listing" class="display" summary="{ts escape='htmlattribute'}Contribution listings.{/ts}">
         <thead>
         <tr>
           <th class='link'>{ts}Contributor's Name{/ts}</th>
@@ -222,7 +222,7 @@
             <td>
               <a href="{crmURL p='civicrm/contact/view'
               q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.sort_name}</a>
             </td>
             <td>{$row.contribution_total_amount|crmMoney}</td>
             <td>{$row.financial_type}</td>
@@ -241,7 +241,7 @@
     {if !$table and $summary.addShowAllLink.Contribution}
       <div class="crm-section full-text-view-all-section">
         <a href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=Contribution&text=$text"}"
-        title="{ts}View all results for contributions{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for contributions{/ts}</a>
+        title="{ts escape='htmlattribute'}View all results for contributions{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for contributions{/ts}</a>
       </div>
     {/if}
     {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
@@ -257,7 +257,7 @@
       : {if !$table}{if $summary.Count.Participant <= $limit}{$summary.Count.Participant}{else}{ts 1=$limit}%1 or more{/ts}{/if}{else}{$summary.Count.Participant}{/if}</h3>
     {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
     {* This section displays the rows along and includes the paging controls *}
-      <table id="participant_listing" class="display" summary="{ts}Participant listings.{/ts}">
+      <table id="participant_listing" class="display" summary="{ts escape='htmlattribute'}Participant listings.{/ts}">
         <thead>
         <tr>
           <th class='link'>{ts}Participant's Name{/ts}</th>
@@ -277,7 +277,7 @@
           <tr class="{cycle values="odd-row,even-row"}">
             <td>
               <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.sort_name}</a>
             </td>
             <td>{$row.event_title}</td>
             <td>{$row.participant_fee_level}</td>
@@ -298,7 +298,7 @@
     {if !$table and $summary.addShowAllLink.Participant}
       <div class="crm-section full-text-view-all-section"><a
         href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=Participant&text=$text"}"
-        title="{ts}View all results for participants{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for participants{/ts}</a>
+        title="{ts escape='htmlattribute'}View all results for participants{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for participants{/ts}</a>
       </div>{/if}
     {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
     {* END Actions/Results section *}
@@ -313,7 +313,7 @@
       : {if !$table}{if $summary.Count.Membership <= $limit}{$summary.Count.Membership}{else}{ts 1=$limit}%1 or more{/ts}{/if}{else}{$summary.Count.Membership}{/if}</h3>
     {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
     {* This section displays the rows along and includes the paging controls *}
-      <table id="membership_listing" class="display" summary="{ts}Membership listings.{/ts}">
+      <table id="membership_listing" class="display" summary="{ts escape='htmlattribute'}Membership listings.{/ts}">
         <thead>
         <tr>
           <th class='link'>{ts}Member's Name{/ts}</th>
@@ -333,7 +333,7 @@
           <tr class="{cycle values="odd-row,even-row"}">
             <td>
               <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&context=fulltext&key=`$qfKey`"}"
-                title="{ts}View Contact Details{/ts}">{$row.sort_name}</a>
+                title="{ts escape='htmlattribute'}View Contact Details{/ts}">{$row.sort_name}</a>
             </td>
             <td>{$row.membership_type}</td>
             <td>{$row.membership_fee|crmMoney}</td>
@@ -354,7 +354,7 @@
     {if !$table and $summary.addShowAllLink.Membership}
       <div class="crm-section full-text-view-all-section">
         <a href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=Membership&text=$text"}"
-        title="{ts}View all results for memberships{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for memberships{/ts}</a>
+        title="{ts escape='htmlattribute'}View all results for memberships{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for memberships{/ts}</a>
       </div>
     {/if}
     {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
@@ -375,7 +375,7 @@
   {if $table}{include file="CRM/common/pager.tpl" location="top"}{/if}
 
   {* This section displays the rows along and includes the paging controls *}
-  <table id="file_listing" class="display" summary="{ts}File listings.{/ts}">
+  <table id="file_listing" class="display" summary="{ts escape='htmlattribute'}File listings.{/ts}">
     <thead>
     <tr>
       <th class='link'>{ts}File Name{/ts}</th>
@@ -400,7 +400,7 @@
   {if !$table and $summary.addShowAllLink.File}
   <div class="crm-section full-text-view-all-section">
     <a href="{crmURL p='civicrm/contact/search/custom' q="csid=`$csID`&reset=1&force=1&table=File&text=$text"}"
-          title="{ts}View all results for files{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for files{/ts}</a>
+          title="{ts escape='htmlattribute'}View all results for files{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {ts}View all results for files{/ts}</a>
   </div>{/if}
   {if $table}{include file="CRM/common/pager.tpl" location="below"}{/if}
 {* END Actions/Results section *}

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/MultipleValues.tpl

@@ -43,7 +43,7 @@
         {include file="CRM/common/pagerAToZ.tpl"}
 
         {strip}
-        <table class="selector row-highlight" summary="{ts}Search results listings.{/ts}">
+        <table class="selector row-highlight" summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
             <thead class="sticky">
                 <th scope="col" title="Select All Rows">{$form.toggleSelect.html}</th>
                 {foreach from=$columnHeaders item=header}

ext/legacycustomsearches/templates/CRM/Contact/Form/Search/Custom/Proximity.tpl

@@ -66,7 +66,7 @@
         {/if}
 
         {strip}
-        <table class="selector row-highlight" summary="{ts}Search results listings.{/ts}">
+        <table class="selector row-highlight" summary="{ts escape='htmlattribute'}Search results listings.{/ts}">
             <thead class="sticky">
                 <th scope="col" title="Select All Rows">{$form.toggleSelect.html}</th>
                 {foreach from=$columnHeaders item=header}

ext/legacycustomsearches/templates/CRM/Contact/Page/CustomSearch.tpl

@@ -16,7 +16,7 @@
 {if $rows}
     {foreach from=$rows item=customTitle key=csid}
         <div class="action-link">
-            <a href="{crmURL p="civicrm/contact/search/custom" q="csid=`$csid`&reset=1"}" title="{ts}Use this search{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {$customTitle}</a>
+            <a href="{crmURL p="civicrm/contact/search/custom" q="csid=`$csid`&reset=1"}" title="{ts escape='htmlattribute'}Use this search{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i> {$customTitle}</a>
         </div>
     {/foreach}
 {else}

templates/CRM/ACL/Page/ACL.tpl

@@ -61,7 +61,7 @@
       </div>
     {else}
       <div class="messages status no-popup">
-        <img src="{$config->resourceBase}i/Inform.gif" alt="{ts}status{/ts}"/>
+        <img src="{$config->resourceBase}i/Inform.gif" alt="{ts escape='htmlattribute'}status{/ts}"/>
         {capture assign=crmURL}{crmURL q="action=add&reset=1"}{/capture}
         {ts 1=$crmURL}There are no ACLs entered. You can <a href='%1'>add one</a>.{/ts}
       </div>

templates/CRM/ACL/Page/EntityRole.tpl

@@ -52,7 +52,7 @@
 </div>
 {elseif $action ne 1 and $action ne 2 and $action ne 8}
     <div class="messages status no-popup">
-         <img src="{$config->resourceBase}i/Inform.gif" alt="{ts}status{/ts}"/>
+         <img src="{$config->resourceBase}i/Inform.gif" alt="{ts escape='htmlattribute'}status{/ts}"/>
         {capture assign=crmURL}{crmURL q="action=add&reset=1"}{/capture}
         {ts 1=$crmURL}There are no Role Assignments. You can <a href='%1'>add one</a> now.{/ts}
     </div>

templates/CRM/Activity/Form/Activity.tpl

@@ -75,7 +75,7 @@
         {$form.assignee_contact_id.html}
         {if $action neq 4}
           {if empty($disable_swap_button)}
-            <a href="#" class="crm-hover-button" id="swap_target_assignee" title="{ts}Swap Target and Assignee Contacts{/ts}" style="position:relative; bottom: 1em;">
+            <a href="#" class="crm-hover-button" id="swap_target_assignee" title="{ts escape='htmlattribute'}Swap Target and Assignee Contacts{/ts}" style="position:relative; bottom: 1em;">
               <i class="crm-i fa-random" aria-hidden="true"></i>
             </a>
           {/if}
@@ -240,7 +240,7 @@
       {if ($context eq 'fulltext' || $context eq 'search') && $searchKey}
         {assign var='urlParams' value="reset=1&atype=$atype&action=update&reset=1&id=$entityID&cid=$contactId&context=$context&key=$searchKey"}
       {/if}
-      <a href="{crmURL p='civicrm/activity/add' q=$urlParams}" class="edit button" title="{ts}Edit{/ts}"><span><i class="crm-i fa-pencil" aria-hidden="true"></i> {ts}Edit{/ts}</span></a>
+      <a href="{crmURL p='civicrm/activity/add' q=$urlParams}" class="edit button" title="{ts escape='htmlattribute'}Edit{/ts}"><span><i class="crm-i fa-pencil" aria-hidden="true"></i> {ts}Edit{/ts}</span></a>
     {/if}
 
     {crmPermission has='delete activities'}
@@ -248,11 +248,11 @@
       {if ($context eq 'fulltext' || $context eq 'search') && $searchKey}
         {assign var='urlParams' value="reset=1&atype=$atype&action=delete&reset=1&id=$entityID&cid=$contactId&context=$context&key=$searchKey"}
       {/if}
-      <a href="{crmURL p='civicrm/contact/view/activity' q=$urlParams}" class="delete button" title="{ts}Delete{/ts}"><span><i class="crm-i fa-trash" aria-hidden="true"></i> {ts}Delete{/ts}</span></a>
+      <a href="{crmURL p='civicrm/contact/view/activity' q=$urlParams}" class="delete button" title="{ts escape='htmlattribute'}Delete{/ts}"><span><i class="crm-i fa-trash" aria-hidden="true"></i> {ts}Delete{/ts}</span></a>
     {/crmPermission}
   {/if}
   {if $action eq 4 and $context != 'case' and call_user_func(array('CRM_Case_BAO_Case','checkPermission'), $activityId, 'File On Case', $atype)}
-    <a href="#" onclick="fileOnCase('file', {$activityId}, null, this); return false;" class="cancel button" title="{ts}File On Case{/ts}"><span><i class="crm-i fa-clipboard" aria-hidden="true"></i> {ts}File on Case{/ts}</span></a>
+    <a href="#" onclick="fileOnCase('file', {$activityId}, null, this); return false;" class="cancel button" title="{ts escape='htmlattribute'}File On Case{/ts}"><span><i class="crm-i fa-clipboard" aria-hidden="true"></i> {ts}File on Case{/ts}</span></a>
     {include file="CRM/Case/Form/ActivityToCase.tpl"}
   {/if}
   {include file="CRM/common/formButtons.tpl" location="bottom"}

templates/CRM/Activity/Form/ActivityLinks.tpl

@@ -10,7 +10,7 @@
 {* Links for scheduling/logging meetings and calls and Sending Email *}
 
 {if $as_select} {* on 3.2, the activities can be either a drop down select (on the activity tab) or a list (on the action menu) *}
-<select name="other_activity" class="crm-form-select crm-select2 crm-action-menu fa-plus" title="{ts}New Activity{/ts}">
+<select name="other_activity" class="crm-form-select crm-select2 crm-action-menu fa-plus" title="{ts escape='htmlattribute'}New Activity{/ts}">
   <option value="">{ts}New Activity{/ts}</option>
 {foreach from=$activityTypes item=act}
   <option value="{$act.url}" data-icon="{$act.icon}">{$act.label}</option>

templates/CRM/Activity/Form/ActivityView.tpl

@@ -22,7 +22,7 @@
        {/if}
        {if (array_key_exists('mailingId', $values) && $values.mailingId)}
            <tr>
-                <td class="label">{ts}With Contact{/ts}</td><td class="view-value"><a href="{$values.mailingId}" title="{ts}View Mailing Report{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i>{ts}Mailing Report{/ts}</a></td>
+                <td class="label">{ts}With Contact{/ts}</td><td class="view-value"><a href="{$values.mailingId}" title="{ts escape='htmlattribute'}View Mailing Report{/ts}"><i class="crm-i fa-chevron-right" aria-hidden="true"></i>{ts}Mailing Report{/ts}</a></td>
            </tr>
        {/if}
         <tr>

templates/CRM/Activity/Form/Selector.tpl

@@ -17,7 +17,7 @@
    <thead class="sticky">
      <tr>
        {if !$single and $context eq 'Search'}
-          <th scope="col" title="{ts}Select rows{/ts}">{$form.toggleSelect.html}</th>
+          <th scope="col" title="{ts escape='htmlattribute'}Select rows{/ts}">{$form.toggleSelect.html}</th>
        {/if}
        {foreach from=$columnHeaders item=header}
           <th scope="col">
@@ -60,13 +60,13 @@
     {if !$row.source_contact_id}
       <em>n/a</em>
     {else}
-      <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.source_contact_id`"}" title="{ts}View contact{/ts}">{$row.source_contact_name|purify}</a>
+      <a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.source_contact_id`"}" title="{ts escape='htmlattribute'}View contact{/ts}">{$row.source_contact_name|purify}</a>
     {/if}
     </td>
 
     <td>
     {if $row.mailingId}
-      <a href="{$row.mailingId}" title="{ts}View Mailing Report{/ts}">{$row.recipients}</a>
+      <a href="{$row.mailingId}" title="{ts escape='htmlattribute'}View Mailing Report{/ts}">{$row.recipients}</a>
     {elseif $row.recipients}
       {$row.recipients}
     {elseif !$row.target_contact_name}
@@ -75,7 +75,7 @@
         {assign var="showTarget" value=0}
         {foreach from=$row.target_contact_name item=targetName key=targetID}
             {if $showTarget < 5}
-                {if $showTarget};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$targetID`"}" title="{ts}View contact{/ts}">{$targetName}</a>
+                {if $showTarget};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$targetID`"}" title="{ts escape='htmlattribute'}View contact{/ts}">{$targetName}</a>
                 {assign var="showTarget" value=$showTarget+1}
             {/if}
         {/foreach}
@@ -90,7 +90,7 @@
         {assign var="showAssignee" value=0}
         {foreach from=$row.assignee_contact_name item=assigneeName key=assigneeID}
             {if $showAssignee < 5}
-                {if $showAssignee};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$assigneeID`"}" title="{ts}View contact{/ts}">{$assigneeName}</a>
+                {if $showAssignee};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$assigneeID`"}" title="{ts escape='htmlattribute'}View contact{/ts}">{$assigneeName}</a>
                 {assign var="showAssignee" value=$showAssignee+1}
             {/if}
         {/foreach}

templates/CRM/Activity/Form/Task/Print.tpl

@@ -39,7 +39,7 @@
              {assign var="showTarget" value=0}
              {foreach from=$row.target_contact_name item=targetName key=targetID}
                 {if $showTarget < 5}
-                   {if $showTarget};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$targetID`"}" title="{ts}View contact{/ts}">{$targetName}</a>
+                   {if $showTarget};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$targetID`"}" title="{ts escape='htmlattribute'}View contact{/ts}">{$targetName}</a>
                      {assign var="showTarget" value=$showTarget+1}
                 {/if}
              {/foreach}
@@ -52,7 +52,7 @@
              {assign var="showAssignee" value=0}
              {foreach from=$row.assignee_contact_name item=assigneeName key=assigneeID}
                 {if $showAssignee < 5}
-                   {if $showAssignee};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$assigneeID`"}" title="{ts}View contact{/ts}">{$assigneeName}</a>
+                   {if $showAssignee};&nbsp;{/if}<a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$assigneeID`"}" title="{ts escape='htmlattribute'}View contact{/ts}">{$assigneeName}</a>
                      {assign var="showAssignee" value=$showAssignee+1}
                 {/if}
              {/foreach}