Handle XSS issue on date poll slots

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

app/inc/smarty.php

@@ -77,6 +77,10 @@ function smarty_modifier_html($html) {
     return Utils::htmlEscape($html);
 }
 
+function smarty_modifier_html_special_chars($html) {
+    return Utils::htmlMailEscape($html);
+}
+
 function smarty_modifier_datepicker_path($lang) {
     $i = 0;
     while (!is_file(path_for_datepicker_locale($lang)) && $i < 3) {

tpl/create_date_poll_step_2.tpl

@@ -70,7 +70,7 @@
                                     <div class="col-sm-2">
                                         <label for="d{$i}-h{$j}" class="sr-only control-label">{__('Generic', 'Time')} {$j+1}</label>
                                         <input type="text" class="form-control hours" title="{$day_value} - {__('Generic', 'Time')} {$j+1}"
-                                               placeholder="{__('Generic', 'Time')} {$j+1}" id="d{$i}-h{$j}" name="horaires{$i}[]" value="{$slot}"/>
+                                               placeholder="{__('Generic', 'Time')} {$j+1}" id="d{$i}-h{$j}" name="horaires{$i}[]" value="{$slot|html_special_chars}"/>
                                     </div>
                                 {/foreach}