From d8108230f9dac45ddbf2b93739f23fc2093697ea Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sun, 15 Oct 2017 11:15:48 +0000
Subject: [PATCH] Merged r16983 to r16985 (#27186).

git-svn-id: http://svn.redmine.org/redmine/branches/3.3-stable@16987 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/helpers/application_helper.rb | 3 ++-
 app/helpers/queries_helper.rb     | 3 ++-
 app/views/timelog/_list.html.erb  | 4 +++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 5183393f5..0c85598e0 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -176,7 +176,8 @@ module ApplicationHelper
     end
     case object.class.name
     when 'Array'
-      object.map {|o| format_object(o, html)}.join(', ').html_safe
+      formatted_objects = object.map {|o| format_object(o, html)}
+      html ? safe_join(formatted_objects, ', ') : formatted_objects.join(', ')
     when 'Time'
       format_time(object)
     when 'Date'
diff --git a/app/helpers/queries_helper.rb b/app/helpers/queries_helper.rb
index 0bea000db..278643191 100644
--- a/app/helpers/queries_helper.rb
+++ b/app/helpers/queries_helper.rb
@@ -129,7 +129,8 @@ module QueriesHelper
   def column_content(column, issue)
     value = column.value_object(issue)
     if value.is_a?(Array)
-      value.collect {|v| column_value(column, issue, v)}.compact.join(', ').html_safe
+      values = value.collect {|v| column_value(column, issue, v)}.compact
+      safe_join(values, ', ')
     else
       column_value(column, issue, value)
     end
diff --git a/app/views/timelog/_list.html.erb b/app/views/timelog/_list.html.erb
index 89e1bc8c3..5ee9eea67 100644
--- a/app/views/timelog/_list.html.erb
+++ b/app/views/timelog/_list.html.erb
@@ -18,7 +18,9 @@
 <% entries.each do |entry| -%>
   <tr class="time-entry <%= cycle("odd", "even") %> hascontextmenu">
     <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", entry.id, false, :id => nil) %></td>
-    <%= raw @query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, entry)}</td>"}.join %>
+    <% @query.inline_columns.each do |column| %>
+    <%= content_tag('td', column_content(column, entry), :class => column.css_classes) %>
+    <% end %>
     <td class="buttons">
     <% if entry.editable_by?(User.current) -%>
         <%= link_to l(:button_edit), edit_time_entry_path(entry),
-- 
2.39.5