From bfd133289169bf4230ee839e6a0183dc9b0f3e8d Mon Sep 17 00:00:00 2001
From: Eric Lippmann <eric.lippmann@netways.de>
Date: Wed, 21 Jan 2015 10:04:14 +0100
Subject: [PATCH] monitoring: Escape host and service display_name in the
 services overview

---
 .../monitoring/application/views/scripts/list/services.phtml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/monitoring/application/views/scripts/list/services.phtml b/modules/monitoring/application/views/scripts/list/services.phtml
index 5241c009b..962d22bda 100644
--- a/modules/monitoring/application/views/scripts/list/services.phtml
+++ b/modules/monitoring/application/views/scripts/list/services.phtml
@@ -107,7 +107,7 @@ foreach ($services as $service):
       <?php if ($service->service_icon_image && ! preg_match('/[\'"]/', $service->service_icon_image)): ?>
       <?= $this->icon($this->resolveMacros($service->service_icon_image, $service)) ?>
       <?php endif ?>
-<a href="<?= $serviceLink ?>"><?= $service->service_display_name ?></a><?php if ($this->showHost): ?> on <a href="<?= $hostLink ?>"><?= $service->host_display_name; ?>
+<a href="<?= $serviceLink ?>"><?= $this->escape($service->service_display_name) ?></a><?php if ($this->showHost): ?> on <a href="<?= $hostLink ?>"><?= $this->escape($service->host_display_name) ?>
 <?php if ($service->host_state != 0): ?>
   (<?= strtoupper(Host::getStateText($service->host_state, true)); ?>)
 <?php endif ?>