Merge remote-tracking branch 'origin/branch-5.6'

diff --cc server/sonar-web/package.json
index efc4aaea629384f888e4a82f5bcc745fdae64bc6,870e2c4ec0a4f692894390e3c04fed5446fa78e1..e44e6d19da4ef4710e9ca6450013e2c9cfe399a2
--- 1/server/sonar-web/package.json
--- 2/server/sonar-web/package.json
+++ b/server/sonar-web/package.json
@@@ -22,16 -19,18 +22,17 @@@
      "backbone": "1.2.3",
      "backbone.marionette": "2.4.3",
      "blueimp-md5": "1.1.1",
 -    "chai": "3.3.0",
 +    "chalk": "1.1.3",
      "classnames": "2.2.0",
      "clipboard": "1.5.5",
 +    "cross-env": "2.0.0",
      "css-loader": "0.23.1",
      "d3": "3.5.6",
 -    "del": "2.0.2",
      "enzyme": "2.2.0",
 -    "eslint": "^2.9.0",
 -    "eslint-plugin-import": "^1.8.0",
 -    "eslint-plugin-react": "^5.1.1",
 -    "event-stream": "3.3.1",
+     "escape-html": "1.0.3",
 +    "eslint": "^3.4.0",
 +    "eslint-plugin-import": "^1.14.0",
 +    "eslint-plugin-react": "^6.2.0",
      "expose-loader": "0.7.1",
      "express": "4.13.4",
      "express-http-proxy": "0.6.0",

diff --cc server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js
index 5292bfa183edc9b2f63275eca711b267ff44c32f,0000000000000000000000000000000000000000..e2c1178a73bd70999883e7e526eda4ca8abdce37
mode 100644,000000..100644
--- 1/server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js
--- /dev/null
+++ b/server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js
@@@ -1,70 -1,0 +1,71 @@@
-         return item.name;
 +/*
 + * SonarQube
 + * Copyright (C) 2009-2016 SonarSource SA
 + * mailto:contact AT sonarsource DOT com
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 3 of the License, or (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public License
 + * along with this program; if not, write to the Free Software Foundation,
 + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 + */
++import escapeHtml from 'escape-html';
 +import ModalFormView from '../../../components/common/modal-form';
 +import Template from '../templates/quality-profiles-change-projects.hbs';
 +import { translate } from '../../../helpers/l10n';
 +import '../../../components/SelectList';
 +
 +export default ModalFormView.extend({
 +  template: Template,
 +
 +  onRender () {
 +    ModalFormView.prototype.onRender.apply(this, arguments);
 +
 +    const { key } = this.options.profile;
 +
 +    const searchUrl = window.baseUrl + '/api/qualityprofiles/projects?key=' +
 +        encodeURIComponent(key);
 +
 +    new window.SelectList({
 +      searchUrl,
 +      el: this.$('#profile-projects'),
 +      width: '100%',
 +      readOnly: false,
 +      focusSearch: false,
 +      format (item) {
++        return escapeHtml(item.name);
 +      },
 +      selectUrl: window.baseUrl + '/api/qualityprofiles/add_project',
 +      deselectUrl: window.baseUrl + '/api/qualityprofiles/remove_project',
 +      extra: {
 +        profileKey: key
 +      },
 +      selectParameter: 'projectUuid',
 +      selectParameterValue: 'uuid',
 +      labels: {
 +        selected: translate('quality_gates.projects.with'),
 +        deselected: translate('quality_gates.projects.without'),
 +        all: translate('quality_gates.projects.all'),
 +        noResults: translate('quality_gates.projects.noResults')
 +      },
 +      tooltips: {
 +        select: translate('quality_profiles.projects.select_hint'),
 +        deselect: translate('quality_profiles.projects.deselect_hint')
 +      }
 +    });
 +  },
 +
 +  onDestroy() {
 +    this.options.loadProjects();
 +    ModalFormView.prototype.onDestroy.apply(this, arguments);
 +  }
 +});
 +

diff --cc server/sonar-web/src/main/js/main/processes.js
index 48f4cfe81ed4200d452511988d3b0fd47e7be19b,c8a8fb935ed30724baed1196a61946510fc2f200..98ac39b6e14998c576663003581e60ecab65c684
--- 1/server/sonar-web/src/main/js/main/processes.js
--- 2/server/sonar-web/src/main/js/main/processes.js
+++ b/server/sonar-web/src/main/js/main/processes.js
@@@ -21,8 -21,8 +21,9 @@@ import $ from 'jquery'
  import _ from 'underscore';
  import Backbone from 'backbone';
  import Marionette from 'backbone.marionette';
+ import escapeHtml from 'escape-html';
  import { translate } from '../helpers/l10n';
 +import { getCSRFTokenName, getCSRFTokenValue } from '../helpers/request';
  
  const defaults = {
    queue: {},