From bfd3258c37b93d00e3c9e30f2e6fdd1ad59a10a9 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Thu, 25 Aug 2016 22:59:22 +0200
Subject: [PATCH] Add missing HTML encoding to TimeModifierTemplatePlugin

---
 .../template/plugin/TimeModifierTemplatePlugin.class.php       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php b/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php
index 592a20c430..63533dd7e7 100644
--- a/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php
+++ b/wcfsetup/install/files/lib/system/template/plugin/TimeModifierTemplatePlugin.class.php
@@ -3,6 +3,7 @@ namespace wcf\system\template\plugin;
 use wcf\system\template\TemplateEngine;
 use wcf\system\WCF;
 use wcf\util\DateUtil;
+use wcf\util\StringUtil;
 
 /**
  * Template modifier plugin which formats a unix timestamp.
@@ -29,7 +30,7 @@ class TimeModifierTemplatePlugin implements IModifierTemplatePlugin {
 		$isFutureDate = ($timestamp > TIME_NOW);
 		$dateTime = $this->getRelativeTime($dateTimeObject, $timestamp, $date, $time, $isFutureDate);
 		
-		return '<time datetime="'.DateUtil::format($dateTimeObject, 'c').'" class="datetime" data-timestamp="'.$timestamp.'" data-date="'.$date.'" data-time="'.$time.'" data-offset="'.$dateTimeObject->getOffset().'"'.($isFutureDate ? ' data-is-future-date="true"' : '').'>'.$dateTime.'</time>';
+		return '<time datetime="'.DateUtil::format($dateTimeObject, 'c').'" class="datetime" data-timestamp="'.$timestamp.'" data-date="'.StringUtil::encodeHTML($date).'" data-time="'.StringUtil::encodeHTML($time).'" data-offset="'.$dateTimeObject->getOffset().'"'.($isFutureDate ? ' data-is-future-date="true"' : '').'>'.$dateTime.'</time>';
 	}
 	
 	/**
-- 
2.20.1