From 9018b36d7acad75f75428ae32b8c386da56066d0 Mon Sep 17 00:00:00 2001
From: Eric Lippmann <eric.lippmann@netways.de>
Date: Wed, 21 Jan 2015 10:03:14 +0100
Subject: [PATCH] monitoring: Escape hostname, service name and event message
 in the eventhistory overview

---
 .../application/views/scripts/list/eventhistory.phtml     | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/monitoring/application/views/scripts/list/eventhistory.phtml b/modules/monitoring/application/views/scripts/list/eventhistory.phtml
index a9516aab1..6d6130a3d 100644
--- a/modules/monitoring/application/views/scripts/list/eventhistory.phtml
+++ b/modules/monitoring/application/views/scripts/list/eventhistory.phtml
@@ -110,21 +110,21 @@ use Icinga\Module\Monitoring\Object\Service;
             'host'      => $event->host,
             'service'   => $event->service
           )); ?>">
-            <?= $event->service; ?>
+            <?= $this->escape($event->service) ?>
           </a>
           <small>
-            <?= $this->translate('on') . ' ' . $event->host; ?>
+            <?= $this->translate('on') . ' ' . $this->escape($event->host) ?>
           </small>
         <?php else: ?>
           <a href="<?= $this->href('monitoring/show/host', array(
             'host' => $event->host
           )); ?>">
-            <?= $event->host; ?>
+            <?= $this->escape($event->host) ?>
           </a>
         <?php endif ?>
           <br>
           <div>
-            <?= $this->icon($icon, $title); ?> <?= empty($msg) ? '' : $msg; ?>
+            <?= $this->icon($icon, $title); ?> <?= empty($msg) ? '' : $this->escape($msg) ?>
           </div>
         </td>
       </tr>