# Quotes in event name clears attendees

**URL:** https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010
**Category:** Bug
**Tags:** events, fixed
**Created:** [April 2, 2025, 12:41pm UTC](https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010 "2025-04-02T12:41:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![dsims](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dsims/32/485916_2.png) [@dsims](https://meta.discourse.org/u/dsims)
#### Post date: [April 2, 2025, 12:41pm UTC](https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010/1 "2025-04-02T12:41:05Z")

</div>

If I put quotes in my [Discourse Calendar and Events](https://meta.discourse.org/t/discourse-calendar-and-event/97376) event name like **Event name:** RSVP “Going” to join

 ![Screenshot](https://global.discourse-cdn.com/meta/original/4X/b/c/1/bc1f543296a2d519a278f811c296039b2d0ac36d.png)

On save causes a 500 error to `PUT /posts/123` (likely due to broken markdown) but the bad part is that **all the attendees appear to be cleared** from the event.

Note: this was used with [Discourse Livestream](https://meta.discourse.org/t/discourse-livestream/341335) but I assume that is unrelated.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 2, 2025, 11:37pm UTC](https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010/2 "2025-04-02T23:37:45Z")

</div>

Yikes, we will have a look at this some time in the coming week.

Given you are getting a 500, can you look in `/logs` and let us know what you see there?

---

<div class="post-metadata">

### Author: ![dsims](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dsims/32/485916_2.png) [@dsims](https://meta.discourse.org/u/dsims)
#### Post date: [April 3, 2025, 3:11am UTC](https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010/3 "2025-04-03T03:11:25Z")

</div>

I think what is happening is the unescaped quotes break the event markup, so no event is detected and the event is [destroyed](https://github.com/discourse/discourse-calendar/blob/cbebb8da6f838401b04855d59c67bc7e7d18884a/app/models/discourse_post_event/event.rb#L327). Then when I remove the quotes and hit save again, a _new_ event is created.

The 500 error during serialization is probably a related side-effect.

```plaintext
NoMethodError (undefined method `end_of_day' for nil)
plugins/discourse-calendar/app/models/discourse_post_event/event.rb:93:in `expired?'
plugins/discourse-calendar/app/models/discourse_post_event/event.rb:279:in `can_user_update_attendance'
plugins/discourse-calendar/app/serializers/discourse_post_event/event_serializer.rb:93:in `can_update_attendance'
(eval at /var/www/discourse/vendor/bundle/ruby/3.3.0/gems/active_model_serializers-0.8.4/lib/active_model/serializer.rb:467):4:in `_fast_attributes'
active_model_serializers (0.8.4) lib/active_model/serializer.rb:468:in `rescue in attributes'
active_model_serializers (0.8.4) lib/active_model/serializer.rb:455:in `attributes'
active_model_serializers (0.8.4) lib/active_model/serializer.rb:480:in `_serializable_hash'
active_model_serializers (0.8.4) lib/active_model/serializer.rb:359:in `serializable_hash'
active_model_serializers (0.8.4) lib/active_model/serializer.rb:347:in `as_json'
activesupport (7.2.2.1) lib/active_support/json/encoding.rb:23:in `encode'
activesupport (7.2.2.1) lib/active_support/json/encoding.rb:23:in `encode'
activesupport (7.2.2.1) lib/active_support/core_ext/object/json.rb:42:in `to_json'
active_model_serializers (0.8.4) lib/active_model/serializer.rb:331:in `to_json'
multi_json (1.15.0) lib/multi_json/adapters/oj.rb:56:in `dump'
multi_json (1.15.0) lib/multi_json/adapters/oj.rb:56:in `dump'
multi_json (1.15.0) lib/multi_json/adapter.rb:25:in `dump'
multi_json (1.15.0) lib/multi_json.rb:139:in `dump'
app/controllers/application_controller.rb:506:in `render_json_dump'
app/controllers/posts_controller.rb:301:in `update'

```

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [April 8, 2025, 1:13pm UTC](https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010/5 "2025-04-08T13:13:02Z")

</div>

Thanks for the report @dsims, this will be fixed once this PR gets merged.

[https://github.com/discourse/discourse-calendar/pull/716](https://github.com/discourse/discourse-calendar/pull/716)

It’s not the “best” fix, but at least the event won’t break if a user enters a `"` in one of the event modal’s fields.

---

<div class="post-metadata">

### Author: ![tannerabread](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tannerabread/32/526153_2.png) [@tannerabread](https://meta.discourse.org/u/tannerabread)
#### Post date: [July 2, 2026, 6:51pm UTC](https://meta.discourse.org/t/quotes-in-event-name-clears-attendees/360010/7 "2026-07-02T18:51:56Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.
