Problem

Every Underscore template in CalendarPortlet (event list, event detail, admin role-param row) currently renders its raw source into the portlet body instead of being interpolated. The events column shows literal text like:

<% if (_(days).size() === 0) { %>
    ...
    <%= day.displayName %>
    ...
    <%= event.attributes.summary %>

…where the actual events should appear. Screenshot before:

| ... small calendar grid ...  | <% if (_(days)... %>... raw template text ... |

Root cause

uPortal's respondr.xsl (uPortal-webapp/src/main/resources/layout/theme/respondr/respondr.xsl, ~line 274) does:

up._ = _.noConflict();
up._.templateSettings = {
    interpolate: /{{=(.+?)}}/g,
    evaluate:    /{{(.+?)}}/g,
    escape:      /{{-([\s\S]+?)}}/g
};

scripts.jsp aliases that same instance via ${n}._ = up._, so every _.template(...) call in this portlet inherits the Mustache delimiters at runtime. The portlet's templates use the standard <% %> / <%= %> sigils, which no longer match anything in the (Mustache) regex. Underscore returns the source unchanged, the rendered HTML is the template, and the user sees the raw Underscore syntax in the events column.

The Mustache override in uPortal is intentional and shipping: Marketplace and other portlets rely on it. Mutating up._.templateSettings back from this portlet would break those.

Fix

Set a per-portlet-namespace ${n}.upcalTemplateSettings object once in scripts.jsp and pass it to every _.template(...) call as the second argument. Underscore 1.8.3's _.template(text, settings) does _.defaults({}, settings, _.templateSettings), so the explicit settings win without touching the shared global.

The regex literals in scripts.jsp are emitted via the ${\"<%\"}...${\"%>\"} EL trick — the same trick the view JSPs already use to write literal Underscore sigils into rendered HTML templates — so JSP's own scriptlet parser doesn't swallow the regex while compiling the page.

Files changed

• scripts.jsp — define ${n}.upcalTemplateSettings.
• calendarWideView.jsp — pass settings to both _.template(...) calls (event list, event detail).
• calendarNarrowView.jsp — same two calls.
• editCalendarDefinition.jsp — pass settings to the role-param row template (the JSP that errored at the screenshot below isn't this one, but the fix is uniform).

Verification

uPortal-start Playwright spec tests/ux/portlets/calendar.spec.ts gets a new regression guard: "event list renders without leaking Underscore template sigils". Asserts the .upcal-event-list does not contain the substring <%. Fails before this PR, passes after redeploying CalendarPortlet.

Visual confirmation: the events column now shows the expected "No events" alert (or the populated day list) instead of raw template text.

Notes

• The same root cause was the bug — every site emits <% %> regex literals through the same EL escape (${\"<%\"}/${\"%>\"}) precisely because JSP cannot tolerate raw <% in the source. I made the same mistake mid-fix and got JspException immediately, which is how I traced the EL-escape pattern back into scripts.jsp.
• I also considered putting the settings object in calendar.js (upcal.tplSettings) so the JSPs would pull it from the compiled JS bundle. Decided against — scripts.jsp already runs per-portlet-instance and namespaces under ${n}, which keeps the override scoped without leaking into other portlets that load this WAR.