From c9401e45433ea45b46f9a8faf1e7e537e4683244 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 10 Jul 2026 18:07:15 +0200
Subject: Fix rrule/url column overflow on events#index

Long RRULEs previously overflowed their column with no wrap point;
now escaped and rendered with a <wbr> after each semicolon, so a
long rule wraps at a clause boundary instead of running off the
table. Deliberately not truncated -- a cut-off RRULE's trailing
clause (BYDAY, BYMONTH, etc.) is usually the most specific part.

The url column is now a real link, truncated with an ellipsis at a
fixed width -- deliberately no tooltip, since hovering a real link
already shows the full address in the browser's own status bar.

rrule_with_break_opportunities splits on the raw string's own
semicolons before escaping each piece, not after -- escaping first
and searching the result for semicolons also matches the ones inside
&lt;/&gt; entities, corrupting anything containing a literal < or >.
---
 app/helpers/events_helper.rb              | 11 +++++++++++
 app/views/events/index.html.erb           |  8 ++++++--
 public/stylesheets/admin.css              | 15 +++++++++++++++
 test/models/helpers/events_helper_test.rb | 21 +++++++++++++++++++++
 4 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/app/helpers/events_helper.rb b/app/helpers/events_helper.rb
index 8a9a878..5e84f53 100644
--- a/app/helpers/events_helper.rb
+++ b/app/helpers/events_helper.rb
@@ -1,2 +1,13 @@
+require 'cgi'
+
 module EventsHelper
+  # Insert a zero-width break opportunity after each semicolon, so a long
+  # RRULE can wrap at a clause boundary instead of overflowing its column.
+  # Deliberately <wbr>, not ellipsis -- unlike a URL, an RRULE's trailing
+  # characters (BYDAY, BYMONTH, etc.) are usually the most specific part,
+  # and truncating them would hide exactly the wrong end of the string.
+  def rrule_with_break_opportunities(rrule)
+    return "" if rrule.blank?
+    raw(rrule.split(';', -1).map { |part| CGI.escapeHTML(part) }.join(';<wbr>'))
+  end
 end
diff --git a/app/views/events/index.html.erb b/app/views/events/index.html.erb
index 8127e3a..3d953d5 100644
--- a/app/views/events/index.html.erb
+++ b/app/views/events/index.html.erb
@@ -22,9 +22,13 @@
     <td><%= link_to event.display_title, event %></td>
     <td><%=h event.start_time %></td>
     <td><%=h event.end_time %></td>
-    <td><%=h event.rrule %></td>
+    <td class="rrule_cell"><span class="rrule_text"><%= rrule_with_break_opportunities(event.rrule) %></span></td>
     <td><%=h event.allday %></td>
-    <td><%=h event.url %></td>
+    <td class="url_cell">
+    <% if event.url.present? %>
+    <span class="truncate"><%= link_to event.url, event.url %></span>
+    <% end %>
+    </td>
     <td><%= event.node ? link_to(event.node_id, node_path(event.node)) : '' %></td>
     <td><%= link_to 'edit', edit_event_path(event) %></td>
   </tr>
diff --git a/public/stylesheets/admin.css b/public/stylesheets/admin.css
index 1a81728..4723f50 100644
--- a/public/stylesheets/admin.css
+++ b/public/stylesheets/admin.css
@@ -519,6 +519,21 @@ table.revisions_table tr:hover {
   background-color: #f1f1f1;
 }
 
+.events_table .rrule_text {
+  display: inline-block;
+  max-width: 300px;
+  overflow-wrap: break-word;
+}
+
+.events_table .truncate {
+  display: inline-block;
+  max-width: 200px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  vertical-align: bottom;
+}
+
 #diffview del {
   background: #ffd7d5;
   color: #82071e;
diff --git a/test/models/helpers/events_helper_test.rb b/test/models/helpers/events_helper_test.rb
index 2e7567e..0486b3e 100644
--- a/test/models/helpers/events_helper_test.rb
+++ b/test/models/helpers/events_helper_test.rb
@@ -1,4 +1,25 @@
 require 'test_helper'
 
 class EventsHelperTest < ActionView::TestCase
+  test "rrule_with_break_opportunities inserts a break opportunity after each semicolon" do
+    result = rrule_with_break_opportunities("FREQ=MONTHLY;BYMONTH=1,2,3;BYDAY=-1TH")
+    assert_equal "FREQ=MONTHLY;<wbr>BYMONTH=1,2,3;<wbr>BYDAY=-1TH", result
+    assert result.html_safe?
+  end
+
+  test "rrule_with_break_opportunities escapes HTML-significant characters" do
+    result = rrule_with_break_opportunities("FREQ=WEEKLY;BYDAY=<script>")
+    assert_no_match /<script>/, result
+    assert_match "&lt;script&gt;", result
+  end
+
+  test "rrule_with_break_opportunities returns an empty string for blank input" do
+    assert_equal "", rrule_with_break_opportunities(nil)
+    assert_equal "", rrule_with_break_opportunities("")
+  end
+
+  test "rrule_with_break_opportunities preserves a trailing semicolon" do
+    result = rrule_with_break_opportunities("FREQ=WEEKLY;")
+    assert_equal "FREQ=WEEKLY;<wbr>", result
+  end
 end
-- 
cgit v1.3