From e59fa13786f1690dbe54646775b10170166d5323 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Fri, 19 Jan 2018 15:25:09 +0100
Subject: [PATCH] Announcements: Render HTML in announcment messages

refs #2641
---
 library/Icinga/Web/Widget/Announcements.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/library/Icinga/Web/Widget/Announcements.php b/library/Icinga/Web/Widget/Announcements.php
index 8481a2856..979dd4b56 100644
--- a/library/Icinga/Web/Widget/Announcements.php
+++ b/library/Icinga/Web/Widget/Announcements.php
@@ -8,6 +8,7 @@ use Icinga\Data\Filter\Filter;
 use Icinga\Forms\Announcement\AcknowledgeAnnouncementForm;
 use Icinga\Web\Announcement\AnnouncementCookie;
 use Icinga\Web\Announcement\AnnouncementIniRepository;
+use Icinga\Web\Helper\HtmlPurifier;
 
 /**
  * Render announcements
@@ -35,12 +36,13 @@ class Announcements extends AbstractWidget
         $announcements = $repo->findActive();
         $announcements->applyFilter($acked);
         if ($announcements->hasResult()) {
+            $purifier = new HtmlPurifier(array('HTML.Allowed' => 'b,a[href|target],i,*[class]'));
             $html = '<ul role="alert" id="announcements">';
             foreach ($announcements as $announcement) {
                 $ackForm = new AcknowledgeAnnouncementForm();
                 $ackForm->populate(array('hash' => $announcement->hash));
                 $html .= '<li><div>'
-                    . $this->view()->escape($announcement->message)
+                    . $purifier->purify($announcement->message)
                     . '</div>'
                     . $ackForm
                     . '</li>';