fix XSS issues with date formatting, fixes #6277

Closes #6277

Merge request studip/studip!4751

1 files changed, 1 insertions, 5 deletions

diff --git a/lib/models/CourseDate.php b/lib/models/CourseDate.php
index 2cf6d99..fd6bc80 100644
--- a/lib/models/CourseDate.php
+++ b/lib/models/CourseDate.php
@@ -342,11 +342,7 @@ class CourseDate extends SimpleORMap implements PrivacyObject, Event
         if (in_array($format, ['include-room', 'long-include-room'])) {
             $room = $this->getRoom();
             if ($room) {
-                $string = sprintf('%s <a href="%s" target="_blank">%s</a>',
-                    $string,
-                    $room->getActionURL('booking_plan'),
-                    htmlReady($room->name)
-                );
+                $string .= ' ' . $room->name;
             } elseif ($this->raum) {
                 //Use the freetext room name:
                 $string .= ' ' . $this->raum;