HTML escape.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6330 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/views/context_menus/time_entries.html.erb b/app/views/context_menus/time_entries.html.erb
index ed6ba4ee76ddf976ed7cb14312617f2113f6d58b..fc665487a7acb2145a0ee5396267584bb35dc5ea 100644 (file)
--- a/app/views/context_menus/time_entries.html.erb
+++ b/app/views/context_menus/time_entries.html.erb
@@ -14,7 +14,7 @@
                <a href="#" class="submenu"><%= l(:field_activity) %></a>
                <ul>
                <% @activities.each do |u| -%>
-                   <li><%= context_menu_link u.name, {:controller => 'timelog', :action => 'bulk_edit', :ids => @time_entries.collect(&:id), :time_entry => {'activity_id' => u}, :back_url => @back}, :method => :post,
+                   <li><%= context_menu_link h(u.name), {:controller => 'timelog', :action => 'bulk_edit', :ids => @time_entries.collect(&:id), :time_entry => {'activity_id' => u}, :back_url => @back}, :method => :post,
                                              :selected => (@time_entry && u == @time_entry.activity), :disabled => !@can[:update] %></li>
                <% end -%>
                    <li><%= context_menu_link l(:label_nobody), {:controller => 'timelog', :action => 'bulk_edit', :ids => @time_entries.collect(&:id), :time_entry => {'activity_id' => 'none'}, :back_url => @back}, :method => :post,