CVE-2022-4444: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of the patch is 7e311be22d3a0a1b53e61cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215431.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-13T09:15Z
Repository: https://github.com/ipti/br.tag
Language: JavaScript
Files changed: app/controllers/ClassesController.php, app/modules/calendar/resources/common/js/calendar.js, app/modules/quiz/resources/common/js/quiz.js, app/modules/timesheet/resources/common/js/timesheet.js, js/classes/class-contents/_initialization.js, js/classes/frequency/_initialization.js, themes/default/views/reports/index.php
Commit date: 2022-08-28 18:47:00 -0300
Commit message: Resolvido issues do XSS

Diff: diff --git a/app/controllers/ClassesController.php b/app/controllers/ClassesController.php
index 472ac8b6..068ef441 100755
--- a/app/controllers/ClassesController.php
+++ b/app/controllers/ClassesController.php
@@ -299,18 +299,18 @@ function actionGetDisciplines()
                                 || `t`.`discipline_13_fk` = `d`.`id`)
                         join `classroom` as `c` on (c.id = t.classroom_id_fk)
                         left join instructor_identification ii on t.instructor_fk = ii.id 
                         where ii.users_fk = " . Yii::app()->user->loginInfos->id . " and t.classroom_id_fk = " . $crid . " order by d.name")->queryAll();
         foreach ($disciplines as $discipline) {
-            echo CHtml::tag('option', array('value' => $discipline['id']), CHtml::encode($disciplinesLabels[$discipline['id']]), true);
+            echo htmlspecialchars(CHtml::tag('option', array('value' => $discipline['id']), CHtml::encode($disciplinesLabels[$discipline['id']]), true));
         }
     } else {
         echo CHtml::tag('option', array('value' => ""), CHtml::encode('Selecione a disciplina'), true);
         $classr = Yii::app()->db->createCommand("select distinct discipline_fk from schedule join edcenso_discipline on edcenso_discipline.id = schedule.discipline_fk where classroom_fk = " . $crid . " order by edcenso_discipline.name")->queryAll();
         foreach ($classr as $i => $discipline) {
             if (isset($discipline['discipline_fk'])) {
-                echo CHtml::tag('option', array('value' => $discipline['discipline_fk']), CHtml::encode($disciplinesLabels[$discipline['discipline_fk']]), true);
+                echo htmlspecialchars(CHtml::tag('option', array('value' => $discipline['discipline_fk']), CHtml::encode($disciplinesLabels[$discipline['discipline_fk']]), true));
             }
         }
     }
 }
 }
diff --git a/app/modules/calendar/resources/common/js/calendar.js b/app/modules/calendar/resources/common/js/calendar.js
index 82217a37..c2b194aa 100755
--- a/app/modules/calendar/resources/common/js/calendar.js
+++ b/app/modules/calendar/resources/common/js/calendar.js
@@ -25,11 +25,11 @@ $(document).on("click", ".create-calendar", function () {
                 $("#myNewCalendar button").attr("disabled", "disabled");
             },
         }).success(function (data) {
             data = JSON.parse(data);
             if (!data.valid) {
-                form.find(".alert").html(data.error).show();
+                form.find(".alert").html(DOMPurify.sanitize(data.error)).show();
                 $("#myNewCalendar .centered-loading-gif").hide();
                 $("#myNewCalendar .modal-body").css("opacity", 1).css("pointer-events", "auto");
                 $("#myNewCalendar button").removeAttr("disabled");
             } else {
                 window.location.reload();
@@ -66,11 +66,11 @@ $(document).on("click", ".edit-calendar-title-button", function () {
             data = JSON.parse(data);
             if (data.valid) {
                 $(".calendar-container[data-id=" + $("#edit-calendar-title-modal").find("#Calendar_id").val() + "]").closest(".accordion-group").find(".accordion-title").text($("#edit-calendar-title-modal").find("#Calendar_title").val());
                 $("#edit-calendar-title-modal").modal("hide");
             } else {
-                $("#edit-calendar-title-modal").find(".alert").html(data.error).show();
+                $("#edit-calendar-title-modal").find(".alert").html(DOMPurify.sanitize(data.error)).show();
             }
         }).complete(function () {
             $("#edit-calendar-title-modal").find(".modal-body").css("opacity", 1).css("pointer-events", "auto");
             $("#edit-calendar-title-modal").find("button").removeAttr("disabled");
             $("#edit-calendar-title-modal").find(".centered-loading-gif").hide();
@@ -104,11 +104,11 @@ $(document).on("click", ".remove-calendar-button", function () {
             $(".accordion").children().length
                 ? $(".no-calendars-alert").hide()
                 : $(".no-calendars-alert").show();
             $("#removeCalendar").modal("hide");
         } else {
-            $("#removeCalendar").find(".alert").html(data.error).show();
+            $("#removeCalendar").find(".alert").html(DOMPurify.sanitize(data.error)).show();
         }
     }).complete(function () {
         $("#removeCalendar .centered-loading-gif").hide();
         $("#removeCalendar .modal-body").css("opacity", 1).css("pointer-events", "auto");
         $("#removeCalendar button").removeAttr("disabled");
@@ -135,11 +135,11 @@ $(document).on("click", ".remove-event-button", function () {
             eventDays.attr("data-id", "-1").removeAttr("data-toggle").removeAttr("data-placement").removeAttr("data-original-title");
             eventDays.parent().removeClass("calendar-" + data.color);
             eventDays.find(".calendar-icon").remove();
             $("#myChangeEvent").modal("hide");
         } else {
-            $("#myChangeEvent").find(".alert").html(data.error).show();
+            $("#myChangeEvent").find(".alert").html(DOMPurify.sanitize(data.error)).show();
         }
     }).complete(function () {
         $("#myChangeEvent .centered-loading-gif").hide();
         $("#myChangeEvent .modal-body").css("opacity", 1).css("pointer-events", "auto");
         $("#myChangeEvent button").removeAttr("disabled");
@@ -236,16 +236,16 @@ $(document).on("click", ".save-event", function (e) {
                 $.each(data.datesToFill, function () {
                     var date = calendar.find(".change-event[data-year=" + this.year + "][data-month=" + this.month + "][data-day=" + this.day + "]");
                     date.attr("data-id", data.eventId).attr("data-toggle", "tooltip").attr("data-placement", "top").attr("data-original-title", data.eventName);
                     date.parent().addClass("calendar-" + data.color);
                     date.children(".calendar-icon").remove();
-                    date.prepend("<i class='calendar-icon fa " + data.icon + "'></i>");
+                    date.prepend("<i class='calendar-icon fa " + DOMPurify.sanitize(data.icon) + "'></i>");
                     $("#myChangeEvent").modal("hide");
                 });
                 $('[data-toggle="tooltip"]').tooltip({container: "body"});
             } else {
-                form.find(".alert").html(data.error).show();
+                form.find(".alert").html(DOMPurify.sanitize(data.error)).show();
             }
         }).complete(function () {
             $("#myChangeEvent .centered-loading-gif").hide();
             $("#myChangeEvent .modal-body").css("opacity", 1).css("pointer-events", "auto");
             $("#myChangeEvent button").removeAttr("disabled");
@@ -318,11 +318,11 @@ $(document).on("click", ".change-calendar-status-button", function () {
                 ? icon.attr("data-original-title", "Indisponibilizar Calendário").find("i").removeClass("fa-eye-slash").addClass("fa-eye")
                 : icon.attr("data-original-title", "Disponibilizar Calendário").find("i").removeClass("fa-eye").addClass("fa-eye-slash");
             $(icon).tooltip({container: "body"});
             $("#changeCalendarStatus").modal("hide");
         } else {
-            $("#changeCalendarStatus").find(".alert").html(data.error).show();
+            $("#changeCalendarStatus").find(".alert").html(DOMPurify.sanitize(data.error)).show();
         }
     }).complete(function () {
         $("#changeCalendarStatus .centered-loading-gif").hide();
         $("#changeCalendarStatus .modal-body").css("opacity", 1).css("pointer-events", "auto");
         $("#changeCalendarStatus button").removeAttr("disabled");
diff --git a/app/modules/quiz/resources/common/js/quiz.js b/app/modules/quiz/resources/common/js/quiz.js
index b3964a12..c9d7a349 100644
--- a/app/modules/quiz/resources/common/js/quiz.js
+++ b/app/modules/quiz/resources/common/js/quiz.js
@@ -1,63 +1,63 @@
-$('#save_button').click(function() { 
+$('#save_button').click(function() {
     $('#quiz-form').submit();
 });
 
 $('#delete_button').click(function() {
     if(confirm('Deseja excluir o questionário')){
         var host = window.location.href;
         var url = host.split('?')[1];
         var action = 'index.php?' + (url.indexOf("update") == -1 ? url.replace('create','delete') : url.replace('update','delete'));
         $('#quiz-form').attr('action', action);
         $('#quiz-form').submit();
-    } 
+    }
 });
 
-$('#save_group_button').click(function() { 
+$('#save_group_button').click(function() {
     $('#group-form').submit();
 });
 
 $('#delete_group_button').click(function() {
     if(confirm('Deseja excluir o grupo')){
         var host = window.location.href;
         var url = host.split('?')[1];
         var action = 'index.php?' + (url.indexOf("update") == -1 ? url.replace('create','delete') : url.replace('update','delete'));
         $('#group-form').attr('action', action);
         $('#group-form').submit();
-    } 
+    }
 });
 
-$('#save_question_group_button').click(function() { 
+$('#save_question_group_button').click(function() {
     $('#questiongroup-form').submit();
 });
 
 $('#delete_question_group_button').click(function() {
     if(confirm('Deseja excluir o grupo')){
         var host = window.location.href;
         var url = host.split('?')[1];
         var action = 'index.php?' + (url.indexOf("update") == -1 ? url.replace('create','delete') : url.replace('update','delete'));
         $('#questiongroup-form').attr('action', action);
         $('#questiongroup-form').submit();
-    } 
+    }
 });
 
 
-$('#save_question_button').click(function() { 
+$('#save_question_button').click(function() {
     $('#question-form').submit();
 });
 
 $('#delete_question_button').click(function() {
     if(confirm('Deseja excluir a questão')){
         var host = window.location.href;
         var url = host.split('?')[1];
         var action = 'index.php?' + (url.indexOf("update") == -1 ? url.replace('create','delete') : url.replace('update','delete'));
         $('#question-form').attr('action', action);
         $('#question-form').submit();
-    } 
+    }
 });
 
-$('#save_answer_button').click(function() { 
+$('#save_answer_button').click(function() {
     $('#answer-form').submit();
 });
 
 var Option = function(){
     var description = $('#QuestionOption_description');
@@ -78,10 +78,13 @@ var Option = function(){
                     data: { r: 'quiz/default/createOption', QuestionOption: data},
                     dataType: 'json',
                     contentType: "application/json; charset=utf-8"
                   })
                 .done(function(data){
+                    data = JSON.stringify(data);
+                    data = DOMPurify.sanitize(data);
+                    data = JSON.parse(data);
                     if(typeof data.errorCode != 'undefined' && data.errorCode == '0'){
                         var element = $('<tr></tr>')
                             .attr({'option-id': data.id, 'option-description': data.description, 'option-answer': data.answer, 'option-complement': data.complement})
                             .append($('<td></td>').text(container.find('tr').length + 1))
                             .append($('<td></td>').text(data.description))
@@ -107,10 +110,13 @@ var Option = function(){
                     data: { r: 'quiz/default/updateOption', id: id.val(), QuestionOption: data},
                     dataType: 'json',
                     contentType: "application/json; charset=utf-8"
                   })
                 .done(function(data){
+                    data = JSON.stringify(data);
+                    data = DOMPurify.sanitize(data);
+                    data = JSON.parse(data);
                     if(typeof data.errorCode != 'undefined' && data.errorCode == '0'){
                        var elementActive = container.find('tr[option-id="'+data.id+'"]');
                         var element = $('<tr></tr>')
                             .attr({'option-id': data.id, 'option-description': data.description, 'option-answer': data.answer, 'option-complement': data.complement})
                             .append($('<td></td>').text(elementActive.children('td:eq(0)').text()))
@@ -233,16 +239,16 @@ var Option = function(){
                 }
             }
             else if(type == 'radio'){
                 var partialUid = uid.substring(0,(uid.length -1));
                 var elementChecked = $('input[id^="'+partialUid+'"]:checked');
-                
+
                 if(isChecked){
                     $('div[id^="'+partialUid+'"]').each(function(){
                         $(this).hide();
                     });
-    
+
                     $('input[id^="'+partialUid+'"]').each(function(){
                         if($(this).attr('type') == 'text')
                             $(this).prop('disabled',true);
                         else if($(this).attr('type') == 'radio')
                             $(this).prop('checked',false);
@@ -284,10 +290,13 @@ var QuizQuestion = function(){
                     data: { r: 'quiz/default/setQuizQuestion', quizId: quizId.val(), questionId: questionId.val(),  QuizQuestion: data},
                     dataType: 'json',
                     contentType: "application/json; charset=utf-8"
                   })
                 .done(function(data){
+                    data = JSON.stringify(data);
+                    data = DOMPurify.sanitize(data);
+                    data = JSON.parse(data);
                     if(typeof data.errorCode != 'undefined' && data.errorCode == '0'){
                         var element = $('<tr></tr>')
                             .attr({'key': data.quizId + '' + data.questionId, 'quiz-id': data.quizId, 'question-id': data.questionId, 'question-description': data.description})
                             .append($('<td></td>').text(container.find('tr').length + 1))
                             .append($('<td></td>').text(data.description))
diff --git a/app/modules/timesheet/resources/common/js/timesheet.js b/app/modules/timesheet/resources/common/js/timesheet.js
index b4012771..13dbe507 100755
--- a/app/modules/timesheet/resources/common/js/timesheet.js
+++ b/app/modules/timesheet/resources/common/js/timesheet.js
@@ -437,33 +437,33 @@ $(document).on("click", ".workloads-activator", function () {
         $(".workloads-activator").addClass("fa-chevron-right").removeClass("fa-chevron-left");
         $(".workloads").hide();
     }
 });
 
-$(document).on("click", ".schedule-selected .instructor-name", function () {
-    var instructorId = $(this).attr("instructor_id");
-    var disciplineId = $(this)
-        .parent()
-        .find(".discipline-name")
-        .attr("discipline_id");
-    var scheduleId = $(this)
-        .parent()
-        .attr("schedule");
-
-    $.ajax({
-        url: getInstructorsUrl,
-        type: "POST",
-        data: {
-            discipline: disciplineId
-        }
-    }).success(function (result) {
-        $("#change-instructor-schedule").val(scheduleId);
-        $("#change-instructor-id").html(result);
-        $("#change-instructor-id").val(instructorId).select2();
-        $("#change-instructor-modal").modal();
-    });
-});
+// $(document).on("click", ".schedule-selected .instructor-name", function () {
+//     var instructorId = $(this).attr("instructor_id");
+//     var disciplineId = $(this)
+//         .parent()
+//         .find(".discipline-name")
+//         .attr("discipline_id");
+//     var scheduleId = $(this)
+//         .parent()
+//         .attr("schedule");
+//
+//     $.ajax({
+//         url: getInstructorsUrl,
+//         type: "POST",
+//         data: {
+//             discipline: disciplineId
+//         }
+//     }).success(function (result) {
+//         $("#change-instructor-schedule").val(scheduleId);
+//         $("#change-instructor-id").html(result);
+//         $("#change-instructor-id").val(instructorId).select2();
+//         $("#change-instructor-modal").modal();
+//     });
+// });
 $(document).on("click", "#change-instructor-button", function () {
     $.ajax({
         url: changeInstructorUrl,
         type: "POST",
         data: {
diff --git a/js/classes/class-contents/_initialization.js b/js/classes/class-contents/_initialization.js
index b284b859..01504668 100755
--- a/js/classes/class-contents/_initialization.js
+++ b/js/classes/class-contents/_initialization.js
@@ -74,11 +74,11 @@ $("#classroom").on("change", function () {
                 },
                 success: function (response) {
                     if (response == "") {
                         $("#disciplines").html("<option value='-1'></option>").trigger("change.select2").show();
                     } else {
-                        $("#disciplines").html(response).trigger("change.select2").show();
+                        $("#disciplines").html(decodeHtml(response)).trigger("change.select2").show();
                     }
                     $(".disciplines-container").show();
                 },
             });
         } else {
diff --git a/js/classes/frequency/_initialization.js b/js/classes/frequency/_initialization.js
index 4a7fa045..e0af854f 100755
--- a/js/classes/frequency/_initialization.js
+++ b/js/classes/frequency/_initialization.js
@@ -87,11 +87,11 @@ $("#classroom").on("change", function () {
                 },
                 success: function (response) {
                     if (response === "") {
                         $("#disciplines").html("<option value='-1'></option>").trigger("change.select2").show();
                     } else {
-                        $("#disciplines").html(response).trigger("change.select2").show();
+                        $("#disciplines").html(decodeHtml(response)).trigger("change.select2").show();
                     }
                     $(".disciplines-container").show();
                 },
             });
         } else {
diff --git a/themes/default/views/reports/index.php b/themes/default/views/reports/index.php
index 34a3c59b..253d9a83 100755
--- a/themes/default/views/reports/index.php
+++ b/themes/default/views/reports/index.php
@@ -9,270 +9,297 @@ $this->pageTitle = 'TAG - ' . Yii::t('default', 'Reports');
 $this->breadcrumbs = array(
     Yii::t('default', 'Reports'),
 );
 ?>
 
-<div class="row-fluid">
-    <div class="span12">
-        <h3 class="heading-mosaic"><?php echo Yii::t('default', 'Reports'); ?></h3>  
-    </div>
-</div>
-
-<div class="innerLR home">
     <div class="row-fluid">
-        <?php if (Yii::app()->user->hasFlash('success')): ?>
-            <div class="alert alert-success">
-                <?php echo Yii::app()->user->getFlash('success') ?>
-            </div>
-            <br/>
-        <?php endif ?>
         <div class="span12">
+            <h3 class="heading-mosaic"><?php echo Yii::t('default', 'Reports'); ?></h3>
+        </div>
+    </div>
+
+    <div class="innerLR home">
+        <div class="row-fluid">
+            <?php if (Yii::app()->user->hasFlash('success')): ?>
+                <div class="alert alert-success">
+                    <?php echo Yii::app()->user->getFlash('success') ?>
+                </div>
+                <br/>
+            <?php endif ?>
+            <div class="span12">
                 <div class="span2">
                     <a href="#" data-toggle="modal" data-target="#reportFamilyBag" class="widget-stats" target="_blank">
-                    <!-- <a  href="<?php //echo Yii::app()->createUrl('reports/BFReport')?>" class="widget-stats"> -->
+                        <!-- <a  href="<?php //echo Yii::app()->createUrl('reports/BFReport')?>" class="widget-stats"> -->
                         <div><i class="fa-percent fa fa-4x"></i></div>
                         <span class="report-title">Frequência para o Bolsa Família</span>
                         <div class="clearfix"></div>
                     </a>
                 </div>
                 <div class="span2">
-                    <a href="<?php echo Yii::app()->createUrl('reports/NumberStudentsPerClassroomReport')?>" class="widget-stats" target="_blank">
+                    <a href="<?php echo Yii::app()->createUrl('reports/NumberStudentsPerClassroomReport') ?>"
+                       class="widget-stats" target="_blank">
                         <div><i class="fa fa-sort-numeric-asc fa-4x"></i></div>
                         <span class="report-title">Número de Alunos por Turma</span>
                         <div class="clearfix"></div>
                     </a>
                 </div>
                 <div class="span2">
-                    <a href="<?php echo Yii::app()->createUrl('reports/InstructorsPerClassroomReport')?>" class="widget-stats" target="_blank">
+                    <a href="<?php echo Yii::app()->createUrl('reports/InstructorsPerClassroomReport') ?>"
+                       class="widget-stats" target="_blank">
                         <div><i class="fa fa-graduation-cap fa-4x"></i></div>
                         <span class="report-title">Professores por Turma</span>
                         <div class="clearfix"></div>
                     </a>
                 </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentsbetween5and14yearsoldreport',array('id'=>Yii::app()->user->school))?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-heartbeat fa-4x"></i></div>
-                    <span class="report-title">Alunos com Idade entre 5 e 14 Anos (SUS)</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/enrollmentcomparativeanalysisreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-exchange fa-4x"></i></div>
-                    <span class="report-title">Análise Comparativa de Matrículas</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/schoolprofessionalnumberbyclassroomreport')?>" class="widget-stats" target="_blank">
-                    <div><span class="glyphicons signal"><i></i></span></div>
-                    <span class="report-title">Número de Profissionais por turma</span>
-                    <div class="clearfix"></div>
-                </a>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentsbetween5and14yearsoldreport', array('id' => Yii::app()->user->school)) ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-heartbeat fa-4x"></i></div>
+                        <span class="report-title">Alunos com Idade entre 5 e 14 Anos (SUS)</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/enrollmentcomparativeanalysisreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-exchange fa-4x"></i></div>
+                        <span class="report-title">Análise Comparativa de Matrículas</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/schoolprofessionalnumberbyclassroomreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><span class="glyphicons signal"><i></i></span></div>
+                        <span class="report-title">Número de Profissionais por turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
             </div>
-        </div>
-        <div class="span12" style="margin: 10px 0 0 0">
+            <div class="span12" style="margin: 10px 0 0 0">
 
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/educationalassistantperclassroomreport',array('id'=>Yii::app()->user->school))?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-handshake-o fa-4x"></i></div>
-                    <span class="report-title">Auxiliar/Assistente Educacional por Turma</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/disciplineandinstructorrelationreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-podcast fa-4x"></i></div>
-                    <span class="report-title">Relação Disciplina/Docente</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/complementaractivityassistantbyclassroomreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-dot-circle-o fa-4x"></i></div>
-                    <span class="report-title">Monitores de Atividade Complementar por Turma</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/classroomwithoutinstructorrelationreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-ban fa-4x"></i></div>
-                    <span class="report-title">Relação Turmas sem Instrutor</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentinstructornumbersrelationreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-users fa-4x"></i></div>
-                    <span class="report-title">Número de Alunos e Professores por Turma</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentsbyclassroomreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-address-book fa-4x"></i></div>
-                    <span class="report-title">Relação de alunos por turma</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-        </div>
-        <div class="span12" style="margin: 10px 0 0 0">
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentsinalphabeticalorderrelationreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-sort-alpha-asc fa-4x"></i></div>
-                    <span class="report-title">Relaçao de Alunos em ordem Alfabética</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentswithdisabilitiesrelationreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-wheelchair fa-4x"></i></div>
-                    <span class="report-title">Relação Acessibilidade</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentsusingschooltransportationrelationreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-bus fa-4x"></i></div>
-                    <span class="report-title">Relação Transporte Escolar</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/incompatiblestudentagebyclassroomreport')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-street-view fa-4x"></i></div>
-                    <span class="report-title">Alunos com Idade Incompatível por Turma</span>
-                    <div class="clearfix"></div>
-                </a>
-            </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/bfrstudentReport')?>" class="widget-stats" target="_blank">
-                    <div><span class="glyphicons justify"><i></i></span></div>
-                    <span class="report-title">Alunos participantes Bolsa Familia</span>
-                    <div class="clearfix"></div>
-                </a>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/educationalassistantperclassroomreport', array('id' => Yii::app()->user->school)) ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-handshake-o fa-4x"></i></div>
+                        <span class="report-title">Auxiliar/Assistente Educacional por Turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/disciplineandinstructorrelationreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-podcast fa-4x"></i></div>
+                        <span class="report-title">Relação Disciplina/Docente</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/complementaractivityassistantbyclassroomreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-dot-circle-o fa-4x"></i></div>
+                        <span class="report-title">Monitores de Atividade Complementar por Turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/classroomwithoutinstructorrelationreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-ban fa-4x"></i></div>
+                        <span class="report-title">Relação Turmas sem Instrutor</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentinstructornumbersrelationreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-users fa-4x"></i></div>
+                        <span class="report-title">Número de Alunos e Professores por Turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentsbyclassroomreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-address-book fa-4x"></i></div>
+                        <span class="report-title">Relação de alunos por turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
             </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentpendingdocument')?>" class="widget-stats" target="_blank">
-                    <div><i class="fa fa-list-ol fa-4x"></i></div>
-                    <span class="report-title">Alunos com Documentos Pendentes</span>
-                    <div class="clearfix"></div>
-                </a>
+            <div class="span12" style="margin: 10px 0 0 0">
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentsinalphabeticalorderrelationreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-sort-alpha-asc fa-4x"></i></div>
+                        <span class="report-title">Relaçao de Alunos em ordem Alfabética</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentswithdisabilitiesrelationreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-wheelchair fa-4x"></i></div>
+                        <span class="report-title">Relação Acessibilidade</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentsusingschooltransportationrelationreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-bus fa-4x"></i></div>
+                        <span class="report-title">Relação Transporte Escolar</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/incompatiblestudentagebyclassroomreport') ?>"
+                       class="widget-stats" target="_blank">
+                        <div><i class="fa fa-street-view fa-4x"></i></div>
+                        <span class="report-title">Alunos com Idade Incompatível por Turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/bfrstudentReport') ?>" class="widget-stats"
+                       target="_blank">
+                        <div><span class="glyphicons justify"><i></i></span></div>
+                        <span class="report-title">Alunos participantes Bolsa Familia</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentpendingdocument') ?>" class="widget-stats"
+                       target="_blank">
+                        <div><i class="fa fa-list-ol fa-4x"></i></div>
+                        <span class="report-title">Alunos com Documentos Pendentes</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
             </div>
-        </div>
-        <div class="span12" style="margin: 10px 0 0 0">
-            <div class="span2">
-                <a href="#" data-toggle="modal" data-target="#report" class="widget-stats" target="_blank">
-                    <div><span class="glyphicons signal"><i></i></span></div>
-                    <span class="report-title">Alunos por turma</span>
-                    <div class="clearfix"></div>
-                </a>
+            <div class="span12" style="margin: 10px 0 0 0">
+                <div class="span2">
+                    <a href="#" data-toggle="modal" data-target="#report" class="widget-stats" target="_blank">
+                        <div><span class="glyphicons signal"><i></i></span></div>
+                        <span class="report-title">Alunos por turma</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
+                <div class="span2">
+                    <a href="<?php echo Yii::app()->createUrl('reports/studentspecialfood') ?>" class="widget-stats"
+                       target="_blank">
+                        <span class="glyphicons fast_food"><i></i></span>
+                        <span class="txt">Alunos - Cardápios Especiais</span>
+                        <div class="clearfix"></div>
+                    </a>
+                </div>
             </div>
-            <div class="span2">
-                <a href="<?php echo Yii::app()->createUrl('reports/studentspecialfood')?>" class="widget-stats" target="_blank">
-                    <span class="glyphicons fast_food"><i></i></span>
-                    <span class="txt">Alunos - Cardápios Especiais</span>
-                    <div class="clearfix"></div>
-                </a>
+            <div class="modal fade" id="report" tabindex="-1" role="dialog" aria-labelledby="New Calendar">
+                <div class="modal-dialog" role="document">
+                    <div class="modal-content">
+                        <div class="modal-header">
+                            <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span
+                                        aria-hidden="true">×</span></button>
+                            <h4 class="modal-title" id="myModalLabel">Escolha a Turma</h4>
+                        </div>
+                        <form class="form-vertical" id="createCalendar" action="/br.tag/?r=calendar" method="post">
+                            <div class="modal-body">
+                                <div class="row-fluid">
+                                    <div class=" span12" style="margin: 10px 0 10px 0;">
+                                        <div class="span4">
+                                            <?php echo CHtml::label(yii::t('default', 'Classroom'), 'classroom', array('class' => 'control-label')); ?>
+                                        </div>
+                                        <div class="span8">
+                                            <?php
+                                            echo CHtml::dropDownList('classroom', '', CHtml::listData(Classroom::model()->findAll(array('condition' => 'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year, 'order' => 'name')), 'id', 'name'), array(
+                                                'key' => 'id',
+                                                'class' => 'select-search-on',
+                                                'prompt' => 'Selecione a turma',
+                                                'ajax' => array(
+                                                    'type' => 'POST',
+                                                    'url' => CController::createUrl('classes/getDisciplines'),
+                                                    'success' => 'function(data){
+                                                        $("#disciplines").html(decodeHtml(data));
+                                                    }'
+                                                )));
+                                            ?>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div class="modal-footer" style="background-color:#FFF;">
+                                    <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
+                                    <a class="btn btn-primary"
+                                       url="<?php echo Yii::app()->createUrl('reports/studentbyclassroomreport'); ?>"
+                                       type="button" value="Gerar" id="buildReport"> Gerar </a>
+                                </div>
+                        </form>
+                    </div>
+                </div>
             </div>
         </div>
-        <div class="modal fade" id="report" tabindex="-1" role="dialog" aria-labelledby="New Calendar">
-            <div class="modal-dialog" role="document">
-                <div class="modal-content">
-                    <div class="modal-header">
-                        <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button>
-                        <h4 class="modal-title" id="myModalLabel">Escolha a Turma</h4>
-                    </div>
-                    <form class="form-vertical" id="createCalendar" action="/br.tag/?r=calendar" method="post">            
+    </div>
+
+    <div class="modal fade" id="reportFamilyBag" tabindex="-1" role="dialog">
+        <div class="modal-dialog" role="documentBag">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span
+                                aria-hidden="true">×</span></button>
+                    <h4 class="modal-title">Frequência Bolsa Família - Escolha a Turma</h4>
+                </div>
+                <form class="form-vertical" action="/br.tag/?r=calendar" method="post">
                     <div class="modal-body">
                         <div class="row-fluid">
                             <div class=" span12" style="margin: 10px 0 10px 0;">
                                 <div class="span4">
                                     <?php echo CHtml::label(yii::t('default', 'Classroom'), 'classroom', array('class' => 'control-label')); ?>
                                 </div>
                                 <div class="span8">
-                                     <?php
-                                        echo CHtml::dropDownList('classroom', '', CHtml::listData(Classroom::model()->findAll(array('condition'=>'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year,'order' => 'name')), 'id', 'name'), array(
-                                            'key' => 'id',
-                                            'class' => 'select-search-on',
-                                            'prompt' => 'Selecione a turma',
-                                            'ajax' => array(
-                                                'type' => 'POST',
-                                                'url' => CController::createUrl('classes/getDisciplines'),
-                                                'update' => '#disciplines',
-                                        )));
-                                    ?>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="modal-footer" style="background-color:#FFF;">
-                            <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
-                            <a class="btn btn-primary" url="<?php echo Yii::app()->createUrl('reports/studentbyclassroomreport'); ?>" type="button" value="Gerar" id="buildReport"> Gerar </a>         
-                        </div>
-                    </form>        
-                </div>
-            </div>
-        </div>
-    </div>
-</div>
-
-<div class="modal fade" id="reportFamilyBag" tabindex="-1" role="dialog">
-    <div class="modal-dialog" role="documentBag">
-        <div class="modal-content">
-            <div class="modal-header">
-                <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button>
-                <h4 class="modal-title">Frequência Bolsa Família - Escolha a Turma</h4>
-            </div>
-            <form class="form-vertical" action="/br.tag/?r=calendar" method="post">            
-                <div class="modal-body">
-                    <div class="row-fluid">
-                        <div class=" span12" style="margin: 10px 0 10px 0;">
-                            <div class="span4">
-                                <?php echo CHtml::label(yii::t('default', 'Classroom'), 'classroom', array('class' => 'control-label')); ?>
-                            </div>
-                            <div class="span8">
-                                <?php
-                                    echo CHtml::dropDownList('classroom2', '', CHtml::listData(Classroom::model()->findAll(array('condition'=>'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year,'order' => 'name')), 'id', 'name'), array(
+                                    <?php
+                                    echo CHtml::dropDownList('classroom2', '', CHtml::listData(Classroom::model()->findAll(array('condition' => 'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year, 'order' => 'name')), 'id', 'name'), array(
                                         'key' => 'id',
                                         'class' => 'select-search-on',
                                         'prompt' => 'Todas as turmas',
                                         'ajax' => array(
                                             'type' => 'POST',
                                             'url' => CController::createUrl('classes/getDisciplines'),
-                                            'update' => '#disciplines',
-                                    )));
-                                ?>
+                                            'success' => 'function(data){
+                                                $("#disciplines").html(decodeHtml(data));
+                                            }'
+                                        )));
+                                    ?>
+                                </div>
                             </div>
                         </div>
                     </div>
-                </div>
 
-                <div class="modal-footer" style="background-color:#FFF;">
-                    <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
-                    <a class="btn btn-primary" url="<?php echo Yii::app()->createUrl('reports/BFReport'); ?>" type="button" value="Gerar" id="buildReportBF"> Gerar </a>         
-                </div>
-            </form>        
+                    <div class="modal-footer" style="background-color:#FFF;">
+                        <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
+                        <a class="btn btn-primary" url="<?php echo Yii::app()->createUrl('reports/BFReport'); ?>"
+                           type="button" value="Gerar" id="buildReportBF"> Gerar </a>
+                    </div>
+                </form>
+            </div>
         </div>
     </div>
-</div>
 
 <?php
 
 $cs = Yii::app()->getClientScript();
-$cs->registerScript('buildReport',"  
+$cs->registerScript('buildReport', "  
     $('#buildReport').live('click', function(event) {
         var url = $(this).attr('url');
         var id = $('#classroom').val();
         $(this).attr('url', url + '&id='+ id);
     });
     registerAndOpenTab('#buildReport');", CClientScript::POS_END);
 
-$cs->registerScript('buildReportBF',"  
+$cs->registerScript('buildReportBF', "  
     $('#buildReportBF').live('click', function(event) {
         var url = $(this).attr('url');
         var id = $('#classroom2').val();
         $(this).attr('url', url + '&id='+ id);
     });
     registerAndOpenTab('#buildReportBF');", CClientScript::POS_END);
 
- ?>
\ No newline at end of file
+?>
\ No newline at end of file

Vulnerable code:             echo CHtml::tag('option', array('value' => $discipline['id']), CHtml::encode($disciplinesLabels[$discipline['id']]), true);
                echo CHtml::tag('option', array('value' => $discipline['discipline_fk']), CHtml::encode($disciplinesLabels[$discipline['discipline_fk']]), true);
                form.find(".alert").html(data.error).show();
                $("#edit-calendar-title-modal").find(".alert").html(data.error).show();
            $("#removeCalendar").find(".alert").html(data.error).show();
            $("#myChangeEvent").find(".alert").html(data.error).show();
                    date.prepend("<i class='calendar-icon fa " + data.icon + "'></i>");
                form.find(".alert").html(data.error).show();
            $("#changeCalendarStatus").find(".alert").html(data.error).show();
$('#save_button').click(function() { 
    } 
$('#save_group_button').click(function() { 
    } 
$('#save_question_group_button').click(function() { 
    } 
$('#save_question_button').click(function() { 
    } 
$('#save_answer_button').click(function() { 
                
    
$(document).on("click", ".schedule-selected .instructor-name", function () {
    var instructorId = $(this).attr("instructor_id");
    var disciplineId = $(this)
        .parent()
        .find(".discipline-name")
        .attr("discipline_id");
    var scheduleId = $(this)
        .parent()
        .attr("schedule");

    $.ajax({
        url: getInstructorsUrl,
        type: "POST",
        data: {
            discipline: disciplineId
        }
    }).success(function (result) {
        $("#change-instructor-schedule").val(scheduleId);
        $("#change-instructor-id").html(result);
        $("#change-instructor-id").val(instructorId).select2();
        $("#change-instructor-modal").modal();
    });
});
                        $("#disciplines").html(response).trigger("change.select2").show();
                        $("#disciplines").html(response).trigger("change.select2").show();
<div class="row-fluid">
    <div class="span12">
        <h3 class="heading-mosaic"><?php echo Yii::t('default', 'Reports'); ?></h3>  
    </div>
</div>

<div class="innerLR home">
        <?php if (Yii::app()->user->hasFlash('success')): ?>
            <div class="alert alert-success">
                <?php echo Yii::app()->user->getFlash('success') ?>
            </div>
            <br/>
        <?php endif ?>
                    <!-- <a  href="<?php //echo Yii::app()->createUrl('reports/BFReport')?>" class="widget-stats"> -->
                    <a href="<?php echo Yii::app()->createUrl('reports/NumberStudentsPerClassroomReport')?>" class="widget-stats" target="_blank">
                    <a href="<?php echo Yii::app()->createUrl('reports/InstructorsPerClassroomReport')?>" class="widget-stats" target="_blank">
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentsbetween5and14yearsoldreport',array('id'=>Yii::app()->user->school))?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-heartbeat fa-4x"></i></div>
                    <span class="report-title">Alunos com Idade entre 5 e 14 Anos (SUS)</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/enrollmentcomparativeanalysisreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-exchange fa-4x"></i></div>
                    <span class="report-title">Análise Comparativa de Matrículas</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/schoolprofessionalnumberbyclassroomreport')?>" class="widget-stats" target="_blank">
                    <div><span class="glyphicons signal"><i></i></span></div>
                    <span class="report-title">Número de Profissionais por turma</span>
                    <div class="clearfix"></div>
                </a>
        </div>
        <div class="span12" style="margin: 10px 0 0 0">
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/educationalassistantperclassroomreport',array('id'=>Yii::app()->user->school))?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-handshake-o fa-4x"></i></div>
                    <span class="report-title">Auxiliar/Assistente Educacional por Turma</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/disciplineandinstructorrelationreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-podcast fa-4x"></i></div>
                    <span class="report-title">Relação Disciplina/Docente</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/complementaractivityassistantbyclassroomreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-dot-circle-o fa-4x"></i></div>
                    <span class="report-title">Monitores de Atividade Complementar por Turma</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/classroomwithoutinstructorrelationreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-ban fa-4x"></i></div>
                    <span class="report-title">Relação Turmas sem Instrutor</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentinstructornumbersrelationreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-users fa-4x"></i></div>
                    <span class="report-title">Número de Alunos e Professores por Turma</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentsbyclassroomreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-address-book fa-4x"></i></div>
                    <span class="report-title">Relação de alunos por turma</span>
                    <div class="clearfix"></div>
                </a>
            </div>
        </div>
        <div class="span12" style="margin: 10px 0 0 0">
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentsinalphabeticalorderrelationreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-sort-alpha-asc fa-4x"></i></div>
                    <span class="report-title">Relaçao de Alunos em ordem Alfabética</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentswithdisabilitiesrelationreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-wheelchair fa-4x"></i></div>
                    <span class="report-title">Relação Acessibilidade</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentsusingschooltransportationrelationreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-bus fa-4x"></i></div>
                    <span class="report-title">Relação Transporte Escolar</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/incompatiblestudentagebyclassroomreport')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-street-view fa-4x"></i></div>
                    <span class="report-title">Alunos com Idade Incompatível por Turma</span>
                    <div class="clearfix"></div>
                </a>
            </div>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/bfrstudentReport')?>" class="widget-stats" target="_blank">
                    <div><span class="glyphicons justify"><i></i></span></div>
                    <span class="report-title">Alunos participantes Bolsa Familia</span>
                    <div class="clearfix"></div>
                </a>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentpendingdocument')?>" class="widget-stats" target="_blank">
                    <div><i class="fa fa-list-ol fa-4x"></i></div>
                    <span class="report-title">Alunos com Documentos Pendentes</span>
                    <div class="clearfix"></div>
                </a>
        </div>
        <div class="span12" style="margin: 10px 0 0 0">
            <div class="span2">
                <a href="#" data-toggle="modal" data-target="#report" class="widget-stats" target="_blank">
                    <div><span class="glyphicons signal"><i></i></span></div>
                    <span class="report-title">Alunos por turma</span>
                    <div class="clearfix"></div>
                </a>
            <div class="span2">
                <a href="<?php echo Yii::app()->createUrl('reports/studentspecialfood')?>" class="widget-stats" target="_blank">
                    <span class="glyphicons fast_food"><i></i></span>
                    <span class="txt">Alunos - Cardápios Especiais</span>
                    <div class="clearfix"></div>
                </a>
        <div class="modal fade" id="report" tabindex="-1" role="dialog" aria-labelledby="New Calendar">
            <div class="modal-dialog" role="document">
                <div class="modal-content">
                    <div class="modal-header">
                        <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button>
                        <h4 class="modal-title" id="myModalLabel">Escolha a Turma</h4>
                    </div>
                    <form class="form-vertical" id="createCalendar" action="/br.tag/?r=calendar" method="post">            
                                     <?php
                                        echo CHtml::dropDownList('classroom', '', CHtml::listData(Classroom::model()->findAll(array('condition'=>'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year,'order' => 'name')), 'id', 'name'), array(
                                            'key' => 'id',
                                            'class' => 'select-search-on',
                                            'prompt' => 'Selecione a turma',
                                            'ajax' => array(
                                                'type' => 'POST',
                                                'url' => CController::createUrl('classes/getDisciplines'),
                                                'update' => '#disciplines',
                                        )));
                                    ?>
                                </div>
                            </div>
                        </div>

                        <div class="modal-footer" style="background-color:#FFF;">
                            <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
                            <a class="btn btn-primary" url="<?php echo Yii::app()->createUrl('reports/studentbyclassroomreport'); ?>" type="button" value="Gerar" id="buildReport"> Gerar </a>         
                        </div>
                    </form>        
                </div>
            </div>
        </div>
    </div>
</div>

<div class="modal fade" id="reportFamilyBag" tabindex="-1" role="dialog">
    <div class="modal-dialog" role="documentBag">
        <div class="modal-content">
            <div class="modal-header">
                <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button>
                <h4 class="modal-title">Frequência Bolsa Família - Escolha a Turma</h4>
            </div>
            <form class="form-vertical" action="/br.tag/?r=calendar" method="post">            
                <div class="modal-body">
                    <div class="row-fluid">
                        <div class=" span12" style="margin: 10px 0 10px 0;">
                            <div class="span4">
                                <?php echo CHtml::label(yii::t('default', 'Classroom'), 'classroom', array('class' => 'control-label')); ?>
                            </div>
                            <div class="span8">
                                <?php
                                    echo CHtml::dropDownList('classroom2', '', CHtml::listData(Classroom::model()->findAll(array('condition'=>'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year,'order' => 'name')), 'id', 'name'), array(
                                            'update' => '#disciplines',
                                    )));
                                ?>
                </div>
                <div class="modal-footer" style="background-color:#FFF;">
                    <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
                    <a class="btn btn-primary" url="<?php echo Yii::app()->createUrl('reports/BFReport'); ?>" type="button" value="Gerar" id="buildReportBF"> Gerar </a>         
                </div>
            </form>        
</div>
$cs->registerScript('buildReport',"  
$cs->registerScript('buildReportBF',"  
 ?>
Fixed code:             echo htmlspecialchars(CHtml::tag('option', array('value' => $discipline['id']), CHtml::encode($disciplinesLabels[$discipline['id']]), true));
                echo htmlspecialchars(CHtml::tag('option', array('value' => $discipline['discipline_fk']), CHtml::encode($disciplinesLabels[$discipline['discipline_fk']]), true));
                form.find(".alert").html(DOMPurify.sanitize(data.error)).show();
                $("#edit-calendar-title-modal").find(".alert").html(DOMPurify.sanitize(data.error)).show();
            $("#removeCalendar").find(".alert").html(DOMPurify.sanitize(data.error)).show();
            $("#myChangeEvent").find(".alert").html(DOMPurify.sanitize(data.error)).show();
                    date.prepend("<i class='calendar-icon fa " + DOMPurify.sanitize(data.icon) + "'></i>");
                form.find(".alert").html(DOMPurify.sanitize(data.error)).show();
            $("#changeCalendarStatus").find(".alert").html(DOMPurify.sanitize(data.error)).show();
$('#save_button').click(function() {
    }
$('#save_group_button').click(function() {
    }
$('#save_question_group_button').click(function() {
    }
$('#save_question_button').click(function() {
    }
$('#save_answer_button').click(function() {
                    data = JSON.stringify(data);
                    data = DOMPurify.sanitize(data);
                    data = JSON.parse(data);
                    data = JSON.stringify(data);
                    data = DOMPurify.sanitize(data);
                    data = JSON.parse(data);


                    data = JSON.stringify(data);
                    data = DOMPurify.sanitize(data);
                    data = JSON.parse(data);
// $(document).on("click", ".schedule-selected .instructor-name", function () {
//     var instructorId = $(this).attr("instructor_id");
//     var disciplineId = $(this)
//         .parent()
//         .find(".discipline-name")
//         .attr("discipline_id");
//     var scheduleId = $(this)
//         .parent()
//         .attr("schedule");
//
//     $.ajax({
//         url: getInstructorsUrl,
//         type: "POST",
//         data: {
//             discipline: disciplineId
//         }
//     }).success(function (result) {
//         $("#change-instructor-schedule").val(scheduleId);
//         $("#change-instructor-id").html(result);
//         $("#change-instructor-id").val(instructorId).select2();
//         $("#change-instructor-modal").modal();
//     });
// });
                        $("#disciplines").html(decodeHtml(response)).trigger("change.select2").show();
                        $("#disciplines").html(decodeHtml(response)).trigger("change.select2").show();
            <h3 class="heading-mosaic"><?php echo Yii::t('default', 'Reports'); ?></h3>
        </div>
    </div>

    <div class="innerLR home">
        <div class="row-fluid">
            <?php if (Yii::app()->user->hasFlash('success')): ?>
                <div class="alert alert-success">
                    <?php echo Yii::app()->user->getFlash('success') ?>
                </div>
                <br/>
            <?php endif ?>
            <div class="span12">
                        <!-- <a  href="<?php //echo Yii::app()->createUrl('reports/BFReport')?>" class="widget-stats"> -->
                    <a href="<?php echo Yii::app()->createUrl('reports/NumberStudentsPerClassroomReport') ?>"
                       class="widget-stats" target="_blank">
                    <a href="<?php echo Yii::app()->createUrl('reports/InstructorsPerClassroomReport') ?>"
                       class="widget-stats" target="_blank">
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentsbetween5and14yearsoldreport', array('id' => Yii::app()->user->school)) ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-heartbeat fa-4x"></i></div>
                        <span class="report-title">Alunos com Idade entre 5 e 14 Anos (SUS)</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/enrollmentcomparativeanalysisreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-exchange fa-4x"></i></div>
                        <span class="report-title">Análise Comparativa de Matrículas</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/schoolprofessionalnumberbyclassroomreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><span class="glyphicons signal"><i></i></span></div>
                        <span class="report-title">Número de Profissionais por turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
            <div class="span12" style="margin: 10px 0 0 0">
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/educationalassistantperclassroomreport', array('id' => Yii::app()->user->school)) ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-handshake-o fa-4x"></i></div>
                        <span class="report-title">Auxiliar/Assistente Educacional por Turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/disciplineandinstructorrelationreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-podcast fa-4x"></i></div>
                        <span class="report-title">Relação Disciplina/Docente</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/complementaractivityassistantbyclassroomreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-dot-circle-o fa-4x"></i></div>
                        <span class="report-title">Monitores de Atividade Complementar por Turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/classroomwithoutinstructorrelationreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-ban fa-4x"></i></div>
                        <span class="report-title">Relação Turmas sem Instrutor</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentinstructornumbersrelationreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-users fa-4x"></i></div>
                        <span class="report-title">Número de Alunos e Professores por Turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentsbyclassroomreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-address-book fa-4x"></i></div>
                        <span class="report-title">Relação de alunos por turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
            <div class="span12" style="margin: 10px 0 0 0">
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentsinalphabeticalorderrelationreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-sort-alpha-asc fa-4x"></i></div>
                        <span class="report-title">Relaçao de Alunos em ordem Alfabética</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentswithdisabilitiesrelationreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-wheelchair fa-4x"></i></div>
                        <span class="report-title">Relação Acessibilidade</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentsusingschooltransportationrelationreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-bus fa-4x"></i></div>
                        <span class="report-title">Relação Transporte Escolar</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/incompatiblestudentagebyclassroomreport') ?>"
                       class="widget-stats" target="_blank">
                        <div><i class="fa fa-street-view fa-4x"></i></div>
                        <span class="report-title">Alunos com Idade Incompatível por Turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/bfrstudentReport') ?>" class="widget-stats"
                       target="_blank">
                        <div><span class="glyphicons justify"><i></i></span></div>
                        <span class="report-title">Alunos participantes Bolsa Familia</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentpendingdocument') ?>" class="widget-stats"
                       target="_blank">
                        <div><i class="fa fa-list-ol fa-4x"></i></div>
                        <span class="report-title">Alunos com Documentos Pendentes</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
            <div class="span12" style="margin: 10px 0 0 0">
                <div class="span2">
                    <a href="#" data-toggle="modal" data-target="#report" class="widget-stats" target="_blank">
                        <div><span class="glyphicons signal"><i></i></span></div>
                        <span class="report-title">Alunos por turma</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
                <div class="span2">
                    <a href="<?php echo Yii::app()->createUrl('reports/studentspecialfood') ?>" class="widget-stats"
                       target="_blank">
                        <span class="glyphicons fast_food"><i></i></span>
                        <span class="txt">Alunos - Cardápios Especiais</span>
                        <div class="clearfix"></div>
                    </a>
                </div>
            <div class="modal fade" id="report" tabindex="-1" role="dialog" aria-labelledby="New Calendar">
                <div class="modal-dialog" role="document">
                    <div class="modal-content">
                        <div class="modal-header">
                            <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span
                                        aria-hidden="true">×</span></button>
                            <h4 class="modal-title" id="myModalLabel">Escolha a Turma</h4>
                        </div>
                        <form class="form-vertical" id="createCalendar" action="/br.tag/?r=calendar" method="post">
                            <div class="modal-body">
                                <div class="row-fluid">
                                    <div class=" span12" style="margin: 10px 0 10px 0;">
                                        <div class="span4">
                                            <?php echo CHtml::label(yii::t('default', 'Classroom'), 'classroom', array('class' => 'control-label')); ?>
                                        </div>
                                        <div class="span8">
                                            <?php
                                            echo CHtml::dropDownList('classroom', '', CHtml::listData(Classroom::model()->findAll(array('condition' => 'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year, 'order' => 'name')), 'id', 'name'), array(
                                                'key' => 'id',
                                                'class' => 'select-search-on',
                                                'prompt' => 'Selecione a turma',
                                                'ajax' => array(
                                                    'type' => 'POST',
                                                    'url' => CController::createUrl('classes/getDisciplines'),
                                                    'success' => 'function(data){
                                                        $("#disciplines").html(decodeHtml(data));
                                                    }'
                                                )));
                                            ?>
                                        </div>
                                    </div>
                                </div>

                                <div class="modal-footer" style="background-color:#FFF;">
                                    <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
                                    <a class="btn btn-primary"
                                       url="<?php echo Yii::app()->createUrl('reports/studentbyclassroomreport'); ?>"
                                       type="button" value="Gerar" id="buildReport"> Gerar </a>
                                </div>
                        </form>
                    </div>
                </div>
    </div>

    <div class="modal fade" id="reportFamilyBag" tabindex="-1" role="dialog">
        <div class="modal-dialog" role="documentBag">
            <div class="modal-content">
                <div class="modal-header">
                    <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span
                                aria-hidden="true">×</span></button>
                    <h4 class="modal-title">Frequência Bolsa Família - Escolha a Turma</h4>
                </div>
                <form class="form-vertical" action="/br.tag/?r=calendar" method="post">
                                    <?php
                                    echo CHtml::dropDownList('classroom2', '', CHtml::listData(Classroom::model()->findAll(array('condition' => 'school_inep_fk=' . Yii::app()->user->school . ' && school_year = ' . Yii::app()->user->year, 'order' => 'name')), 'id', 'name'), array(
                                            'success' => 'function(data){
                                                $("#disciplines").html(decodeHtml(data));
                                            }'
                                        )));
                                    ?>
                                </div>
                    <div class="modal-footer" style="background-color:#FFF;">
                        <button type="button" class="btn btn-default" data-dismiss="modal">Cancelar</button>
                        <a class="btn btn-primary" url="<?php echo Yii::app()->createUrl('reports/BFReport'); ?>"
                           type="button" value="Gerar" id="buildReportBF"> Gerar </a>
                    </div>
                </form>
            </div>
$cs->registerScript('buildReport', "  
$cs->registerScript('buildReportBF', "  
?>