Merged r2168 and r2169 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.7-stable@2175 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/issues/_sidebar.rhtml

@@ -9,6 +9,6 @@
 <h3><%= l(:label_query_plural) %></h3>
 
 <% sidebar_queries.each do |query| -%>
-<%= link_to query.name, :controller => 'issues', :action => 'index', :project_id => @project, :query_id => query %><br />
+<%= link_to(h(query.name), :controller => 'issues', :action => 'index', :project_id => @project, :query_id => query) %><br />
 <% end -%>
 <% end -%>

app/views/wiki/annotate.rhtml

@@ -20,7 +20,7 @@
     <th class="line-num"><%= line_num %></th>
     <td class="revision"><%= link_to line[0], :controller => 'wiki', :action => 'index', :id => @project, :page => @page.title, :version => line[0] %></td>
     <td class="author"><%= h(line[1]) %></td>
-    <td class="line-code"><pre><%= line[2] %></pre></td>
+    <td class="line-code"><pre><%=h line[2] %></pre></td>
 </tr>
 <% line_num += 1 %>
 <% end -%>