HTML escape at app/views/wikis/destroy.rhtml.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6394 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/views/wikis/destroy.rhtml b/app/views/wikis/destroy.rhtml
index b5b1de114864f7c1d607047feb9562a0934c4dd6..75c0eac24d6c5e38fd97e11866ef06bf97b9e989 100644 (file)
--- a/app/views/wikis/destroy.rhtml
+++ b/app/views/wikis/destroy.rhtml
@@ -1,7 +1,7 @@
 <h2><%=l(:label_confirmation)%></h2>
 
 <div class="box"><center>
-<p><strong><%= @project.name %></strong><br /><%=l(:text_wiki_destroy_confirmation)%></p>
+<p><strong><%= h(@project.name) %></strong><br /><%=l(:text_wiki_destroy_confirmation)%></p>
 
 <% form_tag({:controller => 'wikis', :action => 'destroy', :id => @project}) do %>
 <%= hidden_field_tag "confirm", 1 %>