fix(departments) Escape HTML code set in department descriptions

issue #5868

include/class_baseSelector.inc

@@ -238,9 +238,9 @@ class baseSelector
       $this->tree .= "<li><a$selected $link>".
                     '<img class="center" '.
                     'src="'.htmlentities($config->department_info[$base]['img'], ENT_COMPAT, 'UTF-8').'" '.
-                    'alt="'.$config->department_info[$base]['name'].'"/>&nbsp;'.
-                    $this->gennonbreaks($config->department_info[$base]['name']).
-                    ($config->department_info[$base]['description'] == '' ? '' : '&nbsp;<span class="informal">['.$this->gennonbreaks($config->department_info[$base]['description']).']</span>').
+                    'alt="'.htmlentities($config->department_info[$base]['name'], ENT_COMPAT, 'UTF-8').'"/>&nbsp;'.
+                    $this->escape($config->department_info[$base]['name']).
+                    (($config->department_info[$base]['description'] == '') ? '' : '&nbsp;<span class="informal">['.$this->escape($config->department_info[$base]['description']).']</span>').
                     '</a>';
 
       $last_indent  = $indent;
@@ -267,13 +267,13 @@ class baseSelector
 
 
   /*!
-   * \brief Replace all space of the string by non-breaking space
+   * \brief Replace all space of the string by non-breaking space and escapes HTML
    *
    * \param String $string The string which his space will be replaced
    */
   function gennonbreaks($string)
   {
-    return str_replace('-', '&#8209;', str_replace(' ', '&nbsp;', $string));
+    return str_replace(' ', '&nbsp;', htmlentities($string, ENT_COMPAT, 'UTF-8'));
   }
 
   /*!

plugins/admin/departments/class_departmentManagement.inc

@@ -93,10 +93,9 @@ class departmentManagement extends simpleManagement
   {
     $ou = $ou[0];
     if ($dn == $base) {
-      $ou = ".";
+      $ou = '.';
     }
-    $dn = func_get_arg(1);
-    return "<a href='?plug=".$_GET['plug']."&amp;PID=$pid&amp;act=listing_open_$row' title='$dn'>$ou</a>";
+    return '<a href="?plug='.$_GET['plug'].'&amp;PID='.$pid.'&amp;act=listing_open_'.$row.'" title="'.htmlentities($dn, ENT_COMPAT, 'UTF-8').'">'.htmlentities($ou, ENT_COMPAT, 'UTF-8').'</a>';
   }
 
   // Finally remove departments and update departmnet browsers