make multipersonsearch safe, re #3572

Closes #3585 and #3583

Merge request studip/studip!2468

app/views/resources/booking/index.php

@@ -12,7 +12,7 @@
                          ? $booking->resource->getDerivedClassInstance()
                          : null ?>
     <?= $derived_resource
-      ? $derived_resource->getFullName()
+      ? htmlReady($derived_resource->getFullName())
       : _('unbekannt') ?>
 
     <h3><?= _('Zeiträume') ?></h3>
@@ -117,7 +117,7 @@
             <h3><?= _('Gebucht für:') ?></h3>
             <a href="<?= URLHelper::getScriptLink(
                      'dispatch.php/profile',
-                     ['username' => $booking->assigned_user->username]
+                     ['username' =>$booking->assigned_user->username]
                      ) ?>">
                 <?= htmlReady($booking->assigned_user->getFullName()) ?>
             </a>

resources/assets/javascripts/studip-jquery.multi-select.tweaks.js

@@ -29,7 +29,7 @@ import { $gettext } from './lib/gettext.js';
 (function ($, MultiSelect) {
     'use strict';
 
-    var originals = {
+    const originals = {
         generateLisFromOption: MultiSelect.prototype.generateLisFromOption,
         addOption: MultiSelect.prototype.addOption,
         escapeHTML: MultiSelect.prototype.escapeHTML,
@@ -37,16 +37,15 @@ import { $gettext } from './lib/gettext.js';
     };
 
     MultiSelect.prototype.generateLisFromOption = function (option, index, $container) {
-        var $option       = $(option),
-            chunks        = $option.text().split('--');
-
+        let $option = $(option),
+            chunks = $option.html().split(/\s--\s/);
         if (index === -1) {
             $option.prop('disabled', true);
             index = undefined;
         }
 
         if (chunks.length > 1) {
-            $option.attr('style', 'background-image: url(' + chunks.shift()  + ')');
+            $option.attr('style', 'background-image: url(' + encodeURI(chunks.shift().trim())  + ')');
 
             $option.text(chunks.join("\n"));
 
@@ -68,7 +67,7 @@ import { $gettext } from './lib/gettext.js';
     };
 
     MultiSelect.prototype.escapeHTML = function (text) {
-        var result = originals.escapeHTML.call(this, text);
+        const result = originals.escapeHTML.call(this, text);
         return result.replace("\n", '<br>');
     };