From 2fdeabd39831968c5e84d65230ff9f5b65c05605 Mon Sep 17 00:00:00 2001
From: Eric Lippmann <eric.lippmann@netways.de>
Date: Wed, 21 Jan 2015 10:47:20 +0100
Subject: [PATCH] monitoring: Escape host and service name, author and comment
 in the downtimes overview

---
 .../application/views/scripts/list/downtimes.phtml        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/monitoring/application/views/scripts/list/downtimes.phtml b/modules/monitoring/application/views/scripts/list/downtimes.phtml
index 8a8e5576c..616f253c7 100644
--- a/modules/monitoring/application/views/scripts/list/downtimes.phtml
+++ b/modules/monitoring/application/views/scripts/list/downtimes.phtml
@@ -57,20 +57,20 @@ use Icinga\Module\Monitoring\Object\Service;
             'host'      => $downtime->host,
             'service'   => $downtime->service
           )); ?>">
-            <?= $downtime->service; ?>
+            <?= $this->escape($downtime->service) ?>
           </a>
           <small>
-            <?= $this->translate('on'); ?> <?= $downtime->host; ?>
+            <?= $this->translate('on'); ?> <?= $this->escape($downtime->host) ?>
           </small>
         <?php else: ?>
           <?= $this->icon('host'); ?> <a href="<?= $this->href('monitoring/host/show', array(
             'host' => $downtime->host
           )); ?>">
-            <?= $downtime->host; ?>
+            <?= $this->escape($downtime->host) ?>
           </a>
         <?php endif ?>
           <br>
-          <?= $this->icon('comment'); ?> [<?= $downtime->author; ?>] <?= $downtime->comment; ?>
+          <?= $this->icon('comment') ?> [<?= $this->escape($downtime->author) ?>] <?= $this->escape($downtime->comment) ?>
           <br>
           <small>
         <?php if ($downtime->is_flexible): ?>