Escape query names (#2379).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2169 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/views/issues/_sidebar.rhtml b/app/views/issues/_sidebar.rhtml
index 9b7643ba926d8e9a2f676ce2138d63ec90d37736..bbc00f09120e713e4d4cee40a554c73b8c6d8258 100644 (file)
--- a/app/views/issues/_sidebar.rhtml
+++ b/app/views/issues/_sidebar.rhtml
@@ -20,7 +20,7 @@
 <h3><%= l(:label_query_plural) %></h3>
 
 <% sidebar_queries.each do |query| -%>
-<%= link_to query.name, :controller => 'issues', :action => 'index', :project_id => @project, :query_id => query %><br />
+<%= link_to(h(query.name), :controller => 'issues', :action => 'index', :project_id => @project, :query_id => query) %><br />
 <% end -%>
 <%= call_hook(:view_issues_sidebar_queries_bottom) %>
 <% end -%>