From: Tim Düsterhus <duesterhus@woltlab.com>
Date: Thu, 25 Aug 2016 20:59:22 +0000 (+0200)
Subject: Add missing HTML encoding to TimeModifierTemplatePlugin
X-Git-Tag: 3.0.0_Beta_1~498
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=bfd3258c37b93d00e3c9e30f2e6fdd1ad59a10a9;p=GitHub%2FWoltLab%2FWCF.git

Add missing HTML encoding to TimeModifierTemplatePlugin
---

diff --git a/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php b/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php
index 592a20c430..63533dd7e7 100644
--- a/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php
+++ b/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php
@@ -3,6 +3,7 @@ namespace wcf\system\template\plugin;
 use wcf\system\template\TemplateEngine;
 use wcf\system\WCF;
 use wcf\util\DateUtil;
+use wcf\util\StringUtil;
 
 /**
  * Template modifier plugin which formats a unix timestamp.
@@ -29,7 +30,7 @@ class TimeModifierTemplatePlugin implements IModifierTemplatePlugin {
 		$isFutureDate = ($timestamp > TIME_NOW);
 		$dateTime = $this->getRelativeTime($dateTimeObject, $timestamp, $date, $time, $isFutureDate);
 		
-		return '<time datetime="'.DateUtil::format($dateTimeObject, 'c').'" class="datetime" data-timestamp="'.$timestamp.'" data-date="'.$date.'" data-time="'.$time.'" data-offset="'.$dateTimeObject->getOffset().'"'.($isFutureDate ? ' data-is-future-date="true"' : '').'>'.$dateTime.'</time>';
+		return '<time datetime="'.DateUtil::format($dateTimeObject, 'c').'" class="datetime" data-timestamp="'.$timestamp.'" data-date="'.StringUtil::encodeHTML($date).'" data-time="'.StringUtil::encodeHTML($time).'" data-offset="'.$dateTimeObject->getOffset().'"'.($isFutureDate ? ' data-is-future-date="true"' : '').'>'.$dateTime.'</time>';
 	}
 	
 	/**