CVE-2022-4593: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in retra-system. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a6d94ab88f4a6f631a14c59b72461140fb57ae1f. It is recommended to apply a patch to fix this issue. VDB-216186 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-18T08:15Z
Repository: https://github.com/retra/retra-system
Language: Other
Files changed: src/main/java/cz/softinel/retra/core/system/web/SystemController.java, src/main/java/cz/softinel/retra/core/utils/decorator/DateDecorator.java, src/main/java/cz/softinel/retra/core/utils/decorator/EmailDecorator.java, src/main/java/cz/softinel/retra/core/utils/decorator/HourDecorator.java, src/main/java/cz/softinel/retra/core/utils/decorator/HoursDecorator.java, src/main/java/cz/softinel/retra/core/utils/decorator/ScheduleOverviewDecorator.java, src/main/java/cz/softinel/retra/jiraintegration/JiraHelper.java, src/main/java/cz/softinel/retra/jiraintegration/JiraIssue.java, src/main/java/cz/softinel/retra/worklog/blo/WorklogLogicImpl.java, src/main/java/cz/softinel/retra/worklog/web/AbstractWorklogFormController.java, src/main/java/cz/softinel/uaf/lovs/LovsFactory.java, src/main/java/cz/softinel/uaf/vc/tag/SelectTag.java, src/main/webapp/WEB-INF/jsp/Includes.jsp, src/main/webapp/WEB-INF/jsp/retra/ComponentCreate.jsp, src/main/webapp/WEB-INF/jsp/retra/ComponentEdit.jsp, src/main/webapp/WEB-INF/jsp/retra/EmployeeChangeContactInfo.jsp, src/main/webapp/WEB-INF/jsp/retra/EmployeeChangePassword.jsp, src/main/webapp/WEB-INF/jsp/retra/EmployeeCreate.jsp, src/main/webapp/WEB-INF/jsp/retra/EmployeeEdit.jsp, src/main/webapp/WEB-INF/jsp/retra/EmployeeManagement.jsp, src/main/webapp/WEB-INF/jsp/retra/EmployeeView.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateConfirm.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateForm.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchResult.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceCreate.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceEdit.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceList.jsp, src/main/webapp/WEB-INF/jsp/retra/InvoiceView.jsp, src/main/webapp/WEB-INF/jsp/retra/ProjectCreate.jsp, src/main/webapp/WEB-INF/jsp/retra/ProjectEdit.jsp, src/main/webapp/WEB-INF/jsp/retra/ProjectManageComponents.jsp, src/main/webapp/WEB-INF/jsp/retra/ProjectManagement.jsp, src/main/webapp/WEB-INF/jsp/retra/ProjectView.jsp, src/main/webapp/WEB-INF/jsp/retra/ScheduleCopy.jsp, src/main/webapp/WEB-INF/jsp/retra/ScheduleCreate.jsp, src/main/webapp/WEB-INF/jsp/retra/ScheduleEdit.jsp, src/main/webapp/WEB-INF/jsp/retra/ScheduleList.jsp, src/main/webapp/WEB-INF/jsp/retra/ScheduleOverviewList.jsp, src/main/webapp/WEB-INF/jsp/retra/ScheduleView.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogCreate.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogDaily.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogDailyOverview.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogEdit.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogImportConfirm.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogImportMapping.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairConfirm.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairFilter.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogList.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogMonthlyOverview.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogOverview.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogOverviewList.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogProjectOverview.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogView.jsp, src/main/webapp/WEB-INF/jsp/retra/WorklogWeeklyOverview.jsp, src/main/webapp/WEB-INF/jsp/system/ChangeVisualConfiguration.jsp, src/main/webapp/WEB-INF/jsp/system/Login.jsp, src/main/webapp/WEB-INF/jsp/system/RetraError.jsp, src/main/webapp/WEB-INF/lovs/years.xml, src/main/webapp/WEB-INF/news/system-news.xml, src/main/webapp/WEB-INF/resources/about.properties, src/main/webapp/WEB-INF/resources/messages.properties
Commit date: 2022-01-07 14:46:49 +0100
Commit message: RETRA-41 - Specialni znaky v nazvu projektu
RETRA-48 - Chyba při renderování textu worklogu
RETRA-56 - Retra je nachylna na XSS
Diff: diff --git a/src/main/java/cz/softinel/retra/core/system/web/SystemController.java b/src/main/java/cz/softinel/retra/core/system/web/SystemController.java
index 29ce095..4387506 100644
--- a/src/main/java/cz/softinel/retra/core/system/web/SystemController.java
+++ b/src/main/java/cz/softinel/retra/core/system/web/SystemController.java
@@ -417,13 +417,15 @@ public class SystemController extends DispatchController {
 		model.put("projects", projects);
 	}
 
 	private List<Project> filterActiveProject(Set<Project> projects) {
 		List<Project> filtersList = new ArrayList<Project>();
-		for (Project p : projects) {
-			if (p.getState() == Project.STATE_ACTIVE) {
-				filtersList.add(p);
+		if (projects != null && !projects.isEmpty()) {
+			for (Project p : projects) {
+				if (p.getState() == Project.STATE_ACTIVE) {
+					filtersList.add(p);
+				}
 			}
 		}
 		return filtersList;
 	}
 
diff --git a/src/main/java/cz/softinel/retra/core/utils/decorator/DateDecorator.java b/src/main/java/cz/softinel/retra/core/utils/decorator/DateDecorator.java
index 63466dc..ec89901 100644
--- a/src/main/java/cz/softinel/retra/core/utils/decorator/DateDecorator.java
+++ b/src/main/java/cz/softinel/retra/core/utils/decorator/DateDecorator.java
@@ -4,10 +4,11 @@ import java.text.DateFormat;
 import java.text.SimpleDateFormat;
 import java.util.Date;
 
 import javax.servlet.jsp.PageContext;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.displaytag.decorator.DisplaytagColumnDecorator;
 import org.displaytag.exception.DecoratorException;
 import org.displaytag.properties.MediaTypeEnum;
 
 import cz.softinel.retra.core.utils.TypeFormats;
@@ -23,9 +24,13 @@ public class DateDecorator implements DisplaytagColumnDecorator {
 	public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnum media) throws DecoratorException {
 		if (columnValue instanceof Date) {
 			return dateFormat.format(columnValue);
 		}
 
+		if (columnValue instanceof String) {
+			return StringEscapeUtils.escapeHtml(columnValue.toString());
+		}
+		
 		// not date return it as it comes
 		return columnValue;
 	}
 }
diff --git a/src/main/java/cz/softinel/retra/core/utils/decorator/EmailDecorator.java b/src/main/java/cz/softinel/retra/core/utils/decorator/EmailDecorator.java
index a0f22ee..baa4675 100644
--- a/src/main/java/cz/softinel/retra/core/utils/decorator/EmailDecorator.java
+++ b/src/main/java/cz/softinel/retra/core/utils/decorator/EmailDecorator.java
@@ -1,18 +1,20 @@
 package cz.softinel.retra.core.utils.decorator;
 
 import javax.servlet.jsp.PageContext;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.displaytag.decorator.DisplaytagColumnDecorator;
 import org.displaytag.exception.DecoratorException;
 import org.displaytag.properties.MediaTypeEnum;
 
 public class EmailDecorator implements DisplaytagColumnDecorator {
 
 	public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnum media) throws DecoratorException {
 		if (columnValue == null) {
 			return null;
 		}
-		return "<a href='mailto:" + columnValue + "'>" + columnValue + "</a>";
+		String escaped = StringEscapeUtils.escapeHtml(columnValue.toString());
+		return "<a href='mailto:" + escaped + "'>" + escaped + "</a>";
 	}
 
 }
diff --git a/src/main/java/cz/softinel/retra/core/utils/decorator/HourDecorator.java b/src/main/java/cz/softinel/retra/core/utils/decorator/HourDecorator.java
index 5f880e1..6411f62 100644
--- a/src/main/java/cz/softinel/retra/core/utils/decorator/HourDecorator.java
+++ b/src/main/java/cz/softinel/retra/core/utils/decorator/HourDecorator.java
@@ -4,10 +4,11 @@ import java.text.DateFormat;
 import java.text.SimpleDateFormat;
 import java.util.Date;
 
 import javax.servlet.jsp.PageContext;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.displaytag.decorator.DisplaytagColumnDecorator;
 import org.displaytag.exception.DecoratorException;
 import org.displaytag.properties.MediaTypeEnum;
 
 import cz.softinel.retra.core.utils.TypeFormats;
@@ -23,9 +24,13 @@ public class HourDecorator implements DisplaytagColumnDecorator {
 	public Object decorate(Object columnValue, PageContext pageContext, MediaTypeEnum media) throws DecoratorException {
 		if (columnValue instanceof Date) {
 			return dateFormat.format(columnValue);
 		}
 
+		if (columnValue instanceof String) {
+			return StringEscapeUtils.escapeHtml(columnValue.toString());
+		}
+
 		// not date return it as it comes
 		return columnValue;
 	}
 }
diff --git a/src/main/java/cz/softinel/retra/core/utils/decorator/HoursDecorator.java b/src/main/java/cz/softinel/retra/core/utils/decorator/HoursDecorator.java
index 4f6b5fd..82ce405 100644
--- a/src/main/java/cz/softinel/retra/core/utils/decorator/HoursDecorator.java
+++ b/src/main/java/cz/softinel/retra/core/utils/decorator/HoursDecorator.java
@@ -6,10 +6,11 @@ import java.text.NumberFormat;
 import java.util.Locale;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.jsp.PageContext;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.displaytag.decorator.DisplaytagColumnDecorator;
 import org.displaytag.exception.DecoratorException;
 import org.displaytag.properties.MediaTypeEnum;
 import org.springframework.web.servlet.support.RequestContextUtils;
 
@@ -35,9 +36,13 @@ public class HoursDecorator implements DisplaytagColumnDecorator {
 			dfs.setDecimalSeparator('.');
 			NumberFormat formatter = new DecimalFormat(TypeFormats.HOURS_FORMAT, dfs);
 			return formatter.format(columnValue);
 		}
 
+		if (columnValue instanceof String) {
+			return StringEscapeUtils.escapeHtml(columnValue.toString());
+		}
+
 		// not number return it as it comes
 		return columnValue;
 	}
 }
diff --git a/src/main/java/cz/softinel/retra/core/utils/decorator/ScheduleOverviewDecorator.java b/src/main/java/cz/softinel/retra/core/utils/decorator/ScheduleOverviewDecorator.java
index cd9ce5c..32d9eda 100644
--- a/src/main/java/cz/softinel/retra/core/utils/decorator/ScheduleOverviewDecorator.java
+++ b/src/main/java/cz/softinel/retra/core/utils/decorator/ScheduleOverviewDecorator.java
@@ -4,10 +4,11 @@ import java.text.DateFormat;
 import java.text.SimpleDateFormat;
 import java.util.Date;
 
 import javax.servlet.jsp.PageContext;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.displaytag.decorator.DisplaytagColumnDecorator;
 import org.displaytag.exception.DecoratorException;
 import org.displaytag.properties.MediaTypeEnum;
 
 import cz.softinel.retra.schedule.Schedule;
@@ -41,13 +42,13 @@ public class ScheduleOverviewDecorator implements DisplaytagColumnDecorator {
 				sign = "";
 			}
 			Type type = schedule.getType();
 			String typeName = "";
 			if (type != null) {
-				typeName = type.getName();
+				typeName = StringEscapeUtils.escapeHtml(type.getName());
 			}
-			String comment = schedule.getComment();
+			String comment = StringEscapeUtils.escapeHtml(schedule.getComment());
 			if (comment == null) {
 				comment = "";
 			}
 			Long pk = schedule.getPk();
 
@@ -94,9 +95,13 @@ public class ScheduleOverviewDecorator implements DisplaytagColumnDecorator {
 				result = sb.toString();
 			}
 
 		}
 
+		if (columnValue instanceof String) {
+			result = StringEscapeUtils.escapeHtml(columnValue.toString());
+		}
+
 		// not schedule return it as it comes
 		return result;
 	}
 }
diff --git a/src/main/java/cz/softinel/retra/jiraintegration/JiraHelper.java b/src/main/java/cz/softinel/retra/jiraintegration/JiraHelper.java
index 196650a..03fe20d 100644
--- a/src/main/java/cz/softinel/retra/jiraintegration/JiraHelper.java
+++ b/src/main/java/cz/softinel/retra/jiraintegration/JiraHelper.java
@@ -3,10 +3,12 @@ package cz.softinel.retra.jiraintegration;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import org.apache.commons.lang.StringEscapeUtils;
+
 import cz.softinel.retra.jiraintegration.logic.JiraLogic;
 
 public abstract class JiraHelper {
 
 	public static final String JIRA_ISSUE_CODE_REGEXP = "[A-Z][A-Z0-9]{0,9}\\-[1-9]{1}[0-9]{0,9}";
@@ -58,14 +60,15 @@ public abstract class JiraHelper {
 				result = text;
 				for (String code : issues) {
 					JiraIssue issue = jiraLogic.getJiraIssue(code);
 					String title = code;
 					if (issue != null) {
-						title = code + " - " + issue.getSummary();
+						String summary = getSafeJiraText(issue.getSummary());
+						title = code + " - " + summary;
+						String replacement = String.format(url, code, title, code);
+						result = result.replaceAll(code, replacement);
 					}
-					String replacement = String.format(url, code, title, code);
-					result = result.replaceAll(code, replacement);
 				}
 			} else {
 				result = text;
 			}
 		} else {
@@ -73,6 +76,14 @@ public abstract class JiraHelper {
 		}
 
 		return result;
 	}
 
+	public static String getSafeJiraText(final String text) {
+		String safeText = "";
+		if (text != null) {
+			safeText = StringEscapeUtils.escapeHtml(text);
+			safeText = safeText.replace("$", "&dollar;").replace("{", "&lcub;").replace("}", "&rcub;");
+		}
+		return safeText;
+	}
 }
diff --git a/src/main/java/cz/softinel/retra/jiraintegration/JiraIssue.java b/src/main/java/cz/softinel/retra/jiraintegration/JiraIssue.java
index 3c7c558..453916b 100644
--- a/src/main/java/cz/softinel/retra/jiraintegration/JiraIssue.java
+++ b/src/main/java/cz/softinel/retra/jiraintegration/JiraIssue.java
@@ -82,10 +82,16 @@ public class JiraIssue implements Serializable, Comparable<JiraIssue> {
 
 	public void setSelf(String self) {
 		this.self = self;
 	}
 
+	public void setSummary(String summary) {
+		if (fields != null) {
+			this.fields.setSummary(summary); 
+		}
+	}
+
 	public String getSummary() {
 		return fields == null ? null : fields.summary;
 	}
 
 	public boolean isObalka() {
diff --git a/src/main/java/cz/softinel/retra/worklog/blo/WorklogLogicImpl.java b/src/main/java/cz/softinel/retra/worklog/blo/WorklogLogicImpl.java
index d3890b0..6032b78 100644
--- a/src/main/java/cz/softinel/retra/worklog/blo/WorklogLogicImpl.java
+++ b/src/main/java/cz/softinel/retra/worklog/blo/WorklogLogicImpl.java
@@ -1,10 +1,11 @@
 package cz.softinel.retra.worklog.blo;
 
 import java.util.ArrayList;
 import java.util.List;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.Assert;
 
 import cz.softinel.retra.core.blo.AbstractLogicBean;
@@ -425,11 +426,11 @@ public class WorklogLogicImpl extends AbstractLogicBean implements WorklogLogic
 			updateDescriptionGuiImpl(worklog);
 		}
 	}
 
 	private void updateDescriptionGuiImpl(Worklog worklog) {
-		worklog.setDescriptionGui(JiraHelper.getLinkableText(worklog.getDescription(), jiraLogic));
+		worklog.setDescriptionGui(JiraHelper.getLinkableText(StringEscapeUtils.escapeHtml(worklog.getDescription()), jiraLogic));
 	}
 
 	private boolean isGivenEmpLoggedEmployee(Long givenPk) {
 		Long loggedEmployeePk = securityLogic.getLoggedEmployee().getPk();
 
diff --git a/src/main/java/cz/softinel/retra/worklog/web/AbstractWorklogFormController.java b/src/main/java/cz/softinel/retra/worklog/web/AbstractWorklogFormController.java
index 9e704c6..b30d334 100644
--- a/src/main/java/cz/softinel/retra/worklog/web/AbstractWorklogFormController.java
+++ b/src/main/java/cz/softinel/retra/worklog/web/AbstractWorklogFormController.java
@@ -198,10 +198,11 @@ public abstract class AbstractWorklogFormController extends FormController {
 		String ldapLogin = getSecurityLogic().getLoggedUser().getLogin().getLdapLogin();
 		List<JiraIssue> issues = jiraLogic.findJiraIssuesForUser(ldapLogin);
 		if (issues != null && !issues.isEmpty()) {
 			for (JiraIssue ji : issues) {
 				ji.setGuiLink(JiraHelper.getLinkableText(ji.getKey(), "(Show...)", jiraLogic));
+				ji.setSummary(JiraHelper.getSafeJiraText(ji.getSummary()));
 			}
 		}
 		model.put("issues", issues);
 	}
 
diff --git a/src/main/java/cz/softinel/uaf/lovs/LovsFactory.java b/src/main/java/cz/softinel/uaf/lovs/LovsFactory.java
index 5dc3e92..e060555 100644
--- a/src/main/java/cz/softinel/uaf/lovs/LovsFactory.java
+++ b/src/main/java/cz/softinel/uaf/lovs/LovsFactory.java
@@ -81,11 +81,11 @@ public final class LovsFactory extends ApplicationObjectSupport {
 			lovs = new Lovs();
 			loadListOfValues();
 		}
 
 		Lov lov = lovsInMap.get(code);
-		if (lov == null || lov.getFields() != null) {
+		if (lov == null || lov.getFields() == null) {
 			throw new RuntimeException("Missing LOV for code: " + code);
 		}
 		// TODO: Check ... it is good solution?
 		// FIXME: siglp - I think this is not good way, because of calling everytime,
 		// when lov needed. I think
diff --git a/src/main/java/cz/softinel/uaf/vc/tag/SelectTag.java b/src/main/java/cz/softinel/uaf/vc/tag/SelectTag.java
index 79e89bf..11ba6fd 100644
--- a/src/main/java/cz/softinel/uaf/vc/tag/SelectTag.java
+++ b/src/main/java/cz/softinel/uaf/vc/tag/SelectTag.java
@@ -7,10 +7,12 @@ import java.util.Comparator;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
 import org.apache.commons.beanutils.BeanUtils;
+import org.apache.commons.lang.StringEscapeUtils;
+import org.apache.poi.util.StringUtil;
 
 import cz.softinel.uaf.util.CommonHelper;
 
 @SuppressWarnings("serial")
 public class SelectTag extends VisualComponentTag {
@@ -83,11 +85,19 @@ public class SelectTag extends VisualComponentTag {
 					return 1;
 				} else {
 					try {
 						Comparable<String> v1 = BeanUtils.getProperty(o1, orderBy);
 						String v2 = BeanUtils.getProperty(o2, orderBy);
-						return v1.compareTo(v2);
+						if (v1 != null && v2 != null) {
+							return v1.compareTo(v2);							
+						} else {
+							if (v2 == null) {
+								return 0;
+							} else {
+								return -1;
+							}
+						}
 					} catch (IllegalAccessException e) {
 						throw new RuntimeException("Exception while getting property: " + e.getMessage(), e);
 					} catch (InvocationTargetException e) {
 						throw new RuntimeException("Exception while getting property: " + e.getMessage(), e);
 					} catch (NoSuchMethodException e) {
@@ -192,12 +202,15 @@ public class SelectTag extends VisualComponentTag {
 			prefix = "&nbsp;+&nbsp;";
 			for (int i = 0; i < level; i++) {
 				prefix = "&nbsp;&nbsp;&nbsp;&nbsp;" + prefix;
 			}
 		}
+		String escapedValue = StringEscapeUtils.escapeHtml(value);
+		String escapedLabel = StringEscapeUtils.escapeHtml(label);
+		
 		output.append(
-				"\n		<option value='" + value + "'" + selectedAttribute + ">" + prefix + label + "</option>");
+				"\n		<option value='" + escapedValue + "'" + selectedAttribute + ">" + prefix + escapedLabel + "</option>");
 	}
 
 	// Setters ...
 
 	public void setHierarchyKey(String hierarchyKey) {
diff --git a/src/main/resources/cz/softinel/uaf/lov/jaxb.index b/src/main/resources/cz/softinel/uaf/lovs/jaxb.index
similarity index 100%
rename from src/main/resources/cz/softinel/uaf/lov/jaxb.index
rename to src/main/resources/cz/softinel/uaf/lovs/jaxb.index
diff --git a/src/main/webapp/WEB-INF/jsp/Includes.jsp b/src/main/webapp/WEB-INF/jsp/Includes.jsp
index 6ee021a..cf14e5e 100644
--- a/src/main/webapp/WEB-INF/jsp/Includes.jsp
+++ b/src/main/webapp/WEB-INF/jsp/Includes.jsp
@@ -5,10 +5,11 @@
 --%><%@ page import="cz.softinel.uaf.state.StateEntity" %><%--
 
 --%><%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %><%--
 --%><%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %><%--
 --%><%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %><%--
+--%><%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %><%--
 --%><%@ taglib prefix="display" uri="http://displaytag.sf.net" %><%--
 --%><%--
 --%><%@ taglib prefix="vc" uri="/WEB-INF/tld/visual-component.tld" %><%--
 --%><%--
 --%><c:set var="guiRoot" value="gui"/><%--
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ComponentCreate.jsp b/src/main/webapp/WEB-INF/jsp/retra/ComponentCreate.jsp
index 59b710e..7ba93fd 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ComponentCreate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ComponentCreate.jsp
@@ -5,34 +5,34 @@
 <c:set var="requestURI" value="ComponentCreate.do?fkprm=true" />
 
 <form action="${requestURI}" method="post" >
 
 	<spring:bind path="componentForm.pk">
-		<input type="hidden" name="${status.expression}" value="${status.value}" />
+		<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 	</spring:bind>
 
 	<spring:bind path="componentForm.projectPk">
-				<input type="hidden" name="${status.expression}" value="${status.value}" />
+				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 	</spring:bind>
  
 	<table class="formTable">
 		<tr>
 			<spring:bind path="componentForm.code">
 				<th><fmt:message key="entity.component.code" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="componentForm.name">
 				<th><fmt:message key="entity.component.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ComponentEdit.jsp b/src/main/webapp/WEB-INF/jsp/retra/ComponentEdit.jsp
index c17de26..a7bc82c 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ComponentEdit.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ComponentEdit.jsp
@@ -17,22 +17,22 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="componentForm.code">
 				<th><fmt:message key="entity.component.code" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="componentForm.name">
 				<th><fmt:message key="entity.component.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangeContactInfo.jsp b/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangeContactInfo.jsp
index 554db42..70cac5b 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangeContactInfo.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangeContactInfo.jsp
@@ -8,77 +8,77 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.firstName">
 				<th><fmt:message key="entity.contactInfo.firstName" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.lastName">
 				<th><fmt:message key="entity.contactInfo.lastName" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.email">
 				<th><fmt:message key="entity.contactInfo.email" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.web">
 				<th><fmt:message key="entity.contactInfo.web" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.phone1">
 				<th><fmt:message key="entity.contactInfo.phone1" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.phone2">
 				<th><fmt:message key="entity.contactInfo.phone2" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.fax">
 				<th><fmt:message key="entity.contactInfo.fax" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangePassword.jsp b/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangePassword.jsp
index 2119c96..f0c1c73 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangePassword.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/EmployeeChangePassword.jsp
@@ -9,50 +9,50 @@
 		<tr>
 			<spring:bind path="employeeForm.user.login.name">
 				<th><fmt:message key="entity.login.name" /></th>
 				<td>
 					${status.value}
-					<input type="hidden" name="${status.expression}" value="${status.value}" />
+					<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.ldapLogin">
 				<th><fmt:message key="entity.login.ldapLogin" /></th>
 				<td>
 					${status.value}
-					<input type="hidden" name="${status.expression}" value="${status.value}" />
+					<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.passwordOriginal">
 				<th><fmt:message key="entity.login.password.original" /></th>
 				<td>
-					<input type="password" name="${status.expression}" value="${status.value}" />
+					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.password">
 				<th><fmt:message key="entity.login.password.new" /></th>
 				<td>
-					<input type="password" name="${status.expression}" value="${status.value}" />
+					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.passwordConfirmation">
 				<th><fmt:message key="entity.login.password.confirmation" /></th>
 				<td>
-					<input type="password" name="${status.expression}" value="${status.value}" />
+					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/EmployeeCreate.jsp b/src/main/webapp/WEB-INF/jsp/retra/EmployeeCreate.jsp
index aabe65c..40c6a58 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/EmployeeCreate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/EmployeeCreate.jsp
@@ -8,132 +8,132 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.firstName">
 				<th><fmt:message key="entity.contactInfo.firstName" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.lastName">
 				<th><fmt:message key="entity.contactInfo.lastName" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.email">
 				<th><fmt:message key="entity.contactInfo.email" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.web">
 				<th><fmt:message key="entity.contactInfo.web" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.phone1">
 				<th><fmt:message key="entity.contactInfo.phone1" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.phone2">
 				<th><fmt:message key="entity.contactInfo.phone2" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.fax">
 				<th><fmt:message key="entity.contactInfo.fax" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.name">
 				<th><fmt:message key="entity.login.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.ldapLogin">
 				<th><fmt:message key="entity.login.ldapLogin" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.password">
 				<th><fmt:message key="entity.login.password" /></th>
 				<td>
-					<input type="password" name="${status.expression}" value="${status.value}" />
+					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.passwordConfirmation">
 				<th><fmt:message key="entity.login.password.confirmation" /></th>
 				<td>
-					<input type="password" name="${status.expression}" value="${status.value}" />
+					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.icompany">
 				<th><fmt:message key="entity.employee.icompany" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 						<vc:select-option value=""><fmt:message key="employee.icompany.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/EmployeeEdit.jsp b/src/main/webapp/WEB-INF/jsp/retra/EmployeeEdit.jsp
index f690172..1f88f8d 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/EmployeeEdit.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/EmployeeEdit.jsp
@@ -7,127 +7,127 @@
 <c:set var="requestURI" value="EmployeeEdit.do?fkprm=true" />
 
 <form action="${requestURI}" method="post" >
 
 			<spring:bind path="employeeForm.pk">
-				<input type="hidden" name="${status.expression}" value="${status.value}" />
+				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 			</spring:bind>
 
 	<table class="formTable">
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.firstName">
 				<th><fmt:message key="entity.contactInfo.firstName" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.lastName">
 				<th><fmt:message key="entity.contactInfo.lastName" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.email">
 				<th><fmt:message key="entity.contactInfo.email" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.web">
 				<th><fmt:message key="entity.contactInfo.web" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.phone1">
 				<th><fmt:message key="entity.contactInfo.phone1" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.phone2">
 				<th><fmt:message key="entity.contactInfo.phone2" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.fax">
 				<th><fmt:message key="entity.contactInfo.fax" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.contactInfo.jirauser">
 				<th><fmt:message key="entity.contactInfo.jirauser" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.name">
 				<th><fmt:message key="entity.login.name" /></th>
 				<td>
-					<input type="hidden" name="${status.expression}" value="${status.value}" />
-					${status.value}
+					<input type="hidden" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
+					${fn:escapeXml(fn:escapeXml(status.value))}
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.user.login.ldapLogin">
 				<th><fmt:message key="entity.login.ldapLogin" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="employeeForm.icompany">
 				<th><fmt:message key="entity.employee.icompany" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${fn:escapeXml(fn:escapeXml(status.value))}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 						<vc:select-option value=""><fmt:message key="employee.icompany.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -138,11 +138,11 @@
 		<tr>
 			<spring:bind path="employeeForm.igenerate">
 				<th><fmt:message key="entity.employee.igenerate" /></th>
 				<td>
 					<c:choose>
-						<c:when test="${status.value != null && status.value == true}"><input type="checkbox" name="${status.expression}" checked="checked" /></c:when>
+						<c:when test="${fn:escapeXml(status.value) != null && fn:escapeXml(status.value) == true}"><input type="checkbox" name="${status.expression}" checked="checked" /></c:when>
 						<c:otherwise><input type="checkbox" name="${status.expression}" /></c:otherwise>
 					</c:choose>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
@@ -157,11 +157,11 @@
 	<div class="filterDiv"><br /></div>
 	
 	<spring:bind path="employeeForm.projects">
 	<select name="${status.expression}" multiple="multiple">
            <c:forEach items="${projects}" var="project">
-               <c:forEach items="${status.value}" var="currentProject">
+               <c:forEach items="${fn:escapeXml(status.value)}" var="currentProject">
                
                     <c:if test="${currentProject.pk == project.pk}">
                        <c:set var="selected" value="true"/>
                    </c:if>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/EmployeeManagement.jsp b/src/main/webapp/WEB-INF/jsp/retra/EmployeeManagement.jsp
index a141a6c..7fbb621 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/EmployeeManagement.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/EmployeeManagement.jsp
@@ -7,11 +7,11 @@
 
 <display:table name="list" requestURI="${requestURI}" defaultsort="1" pagesize="${defaultPageSize}" id="employee" 
 	sort="list">
 
 	<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" 
-		comparator="${nameComparator}"/>
+		comparator="${nameComparator}" escapeXml="true" />
 	<display:column property="user.contactInfo.email" titleKey="entity.contactInfo.email" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.EmailDecorator"/>
 
 	<display:column property="user.state" titleKey="entity.user.state" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.StateDecorator" />
 	<display:column property="worklog" titleKey="entity.employee.worklog" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.StateDecorator" />
 	<display:column property="igenerate" titleKey="entity.employee.igenerate.short" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.StateDecorator" />
diff --git a/src/main/webapp/WEB-INF/jsp/retra/EmployeeView.jsp b/src/main/webapp/WEB-INF/jsp/retra/EmployeeView.jsp
index ccb2426..d899bd4 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/EmployeeView.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/EmployeeView.jsp
@@ -4,52 +4,52 @@
 
 <form action="EmployeeManagement.do?fkprm=true" method="post" >
 	<table class="formTable">
 		<tr>
 			<th><fmt:message key="entity.contactInfo.displayName" /></th>
-			<td>${employee.user.contactInfo.displayName}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.displayName)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.firstName" /></th>
-			<td>${employee.user.contactInfo.firstName}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.firstName)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.lastName" /></th>
-			<td>${employee.user.contactInfo.lastName}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.lastName)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.email" /></th>
-			<td>${employee.user.contactInfo.email}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.email)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.web" /></th>
-			<td>${employee.user.contactInfo.web}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.web)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.phone1" /></th>
-			<td>${employee.user.contactInfo.phone1}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.phone1)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.phone2" /></th>
-			<td>${employee.user.contactInfo.phone2}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.phone2)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.contactInfo.fax" /></th>
-			<td>${employee.user.contactInfo.fax}</td>
+			<td>${fn:escapeXml(employee.user.contactInfo.fax)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.login.name" /></th>
-			<td>${employee.user.login.name}</td>
+			<td>${fn:escapeXml(employee.user.login.name)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.login.ldapLogin" /></th>
-			<td>${employee.user.login.ldapLogin}</td>
+			<td>${fn:escapeXml(employee.user.login.ldapLogin)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.employee.icompany" /></th>
 			<td>
-				<c:if test="${employee.icompany != null}" >${employee.icompany.codeAndName}</c:if>
+				<c:if test="${employee.icompany != null}" >${fn:escapeXml(employee.icompany.codeAndName)}</c:if>
 				<c:if test="${employee.icompany == null}" >-</c:if>
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.employee.igenerate" /></th>
@@ -63,11 +63,11 @@
 	</table>
 	
 	<br><center><b>Projects</b></center>
 	
 	<display:table name="employee.projects" requestURI="${requestURI}" defaultsort="1" pagesize="${defaultPageSize}" id="project" sort="list">
-		<display:column property="name" titleKey="entity.project.name" sortable="true"/>
+		<display:column property="name" titleKey="entity.project.name" sortable="true" escapeXml="true"/>
 	</display:table>
 	
 	<table class="formTable">
 		<tr class="buttons">
 			<td>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateConfirm.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateConfirm.jsp
index 036e874..0b5bbd4 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateConfirm.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateConfirm.jsp
@@ -5,23 +5,23 @@
 <c:set var="requestURI" value="${requestURI}" />
 
 <table class="formTable">
 	<tr>
 		<th><fmt:message key="entity.invoice.sequence" /></th>
-		<td>${invoiceSeq.codeAndName}</td>
+		<td>${fn:escapeXml(invoiceSeq.codeAndName)}</td>
 	</tr>
 	<tr>
 		<th><fmt:message key="entity.invoice.orderDate" /></th>
-		<td>${form.orderDate}</td>
+		<td>${fn:escapeXml(form.orderDate)}</td>
 	</tr>
 	<tr>
 		<th><fmt:message key="entity.invoice.finishDate" /></th>
-		<td>${form.finishDate}	</td>
+		<td>${fn:escapeXml(form.finishDate)}	</td>
 	</tr>
 	<tr>
 		<th><fmt:message key="entity.invoice.name" /></th>
-		<td>${form.name}</td>
+		<td>${fn:escapeXml(form.name)}</td>
 	</tr>
 </table>
 
 <h3><fmt:message key="invoice.batch.generate.select.employees" /></h3>
 
@@ -32,16 +32,16 @@
 		</display:column>		
 		
 		<!-- data columns -->
 		<display:column titleKey="entity.employee.icompany" media="html" >
 			<!-- this is hack for sorting -->
-			<span class="invisible">${employee.icompany.code}</span>
-			<span title="${employee.icompany.codeAndName}">${employee.icompany.codeAndName}</span>
+			<span class="invisible">${fn:escapeXml(employee.icompany.code)}</span>
+			<span title="${fn:escapeXml(employee.icompany.codeAndName)}">${fn:escapeXml(employee.icompany.codeAndName)}</span>
 		</display:column>
-		<display:column property="employee.icompany" titleKey="entity.employee.icompany" media="csv excel xml pdf rtf"/>
+		<display:column property="employee.icompany" titleKey="entity.employee.icompany" media="csv excel xml pdf rtf" escapeXml="true"/>
 
-		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" 	/>
+		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" escapeXml="true"/>
 
 	</display:table>
 	
 	<br />
 	
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateForm.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateForm.jsp
index a7f4493..6d3e259 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateForm.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchGenerateForm.jsp
@@ -20,11 +20,11 @@
 		<tr>
 			<c:if test="${isCodeGenerated}">
 			<spring:bind path="form.sequence">
 				<th><fmt:message key="entity.invoice.sequence" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 						<vc:select-option value="">--- <fmt:message key="invoice.sequence.please.define" /> ---</vc:select-option>
 					</vc:select> 
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -43,11 +43,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="form.orderDate">
 				<th><fmt:message key="entity.invoice.orderDate" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceOrderDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceOrderDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceOrderDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('invoiceOrderDateId','invoiceOrderDateImgId');
 					// -->
@@ -60,11 +60,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="form.finishDate">
 				<th><fmt:message key="entity.invoice.finishDate" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceFinishDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceFinishDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFinishDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('invoiceFinishDateId','invoiceFinishDateImgId');
 					// -->
@@ -77,11 +77,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="form.name">
 				<th><fmt:message key="entity.invoice.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchResult.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchResult.jsp
index 1563933..7998ce8 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchResult.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceBatchResult.jsp
@@ -14,14 +14,14 @@
 		<display:setProperty name="export.excel.filename" value="invoices.xls" />
 		<display:setProperty name="export.xml.filename" value="invoices.xml" />
 		<display:setProperty name="export.pdf.filename" value="invoices.pdf" />
 		<display:setProperty name="export.rtf.filename" value="invoices.rtf" />
 
-		<display:column property="employee.icompany.codeAndName" titleKey="entity.employee.icompany" sortable="true" />		
-		<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10"/> 
-		<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee"/>
-		<display:column property="name" titleKey="entity.invoice.name" sortable="true" />
+		<display:column property="employee.icompany.codeAndName" titleKey="entity.employee.icompany" sortable="true" escapeXml="true" />		
+		<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10" escapeXml="true" /> 
+		<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee" escapeXml="true" />
+		<display:column property="name" titleKey="entity.invoice.name" sortable="true" escapeXml="true" />
 		
 	</display:table>
 
 	<table class="formTable">
 		<tr class="buttons">
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceCreate.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceCreate.jsp
index 2c4bd4c..e8e51dc 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceCreate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceCreate.jsp
@@ -9,11 +9,11 @@
 		<tr>
 			<c:if test="${isCodeGenerated}">
 			<spring:bind path="invoiceForm.sequence">
 				<th><fmt:message key="entity.invoice.sequence" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 						<vc:select-option value="">--- <fmt:message key="invoice.sequence.please.define" /> ---</vc:select-option>
 					</vc:select> 
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -23,11 +23,11 @@
 			</c:if>
 			<c:if test="${!isCodeGenerated}">
 			<spring:bind path="invoiceForm.code">
 				<th><fmt:message key="entity.invoice.code" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
@@ -35,11 +35,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="invoiceForm.orderDate">
 				<th><fmt:message key="entity.invoice.orderDate" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceOrderDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceOrderDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceOrderDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('invoiceOrderDateId','invoiceOrderDateImgId');
 					// -->
@@ -52,11 +52,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="invoiceForm.finishDate">
 				<th><fmt:message key="entity.invoice.finishDate" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceFinishDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceFinishDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFinishDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('invoiceFinishDateId','invoiceFinishDateImgId');
 					// -->
@@ -69,11 +69,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="invoiceForm.name">
 				<th><fmt:message key="entity.invoice.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceEdit.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceEdit.jsp
index 981cdd7..97744cf 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceEdit.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceEdit.jsp
@@ -4,30 +4,30 @@
 
 <c:set var="requestURI" value="${requestURI}" />
 
 <form action="${requestURI}" method="post" >
 	<spring:bind path="invoiceForm.pk">
-		<input type="hidden" name="${status.expression}" value="${status.value}" />
+		<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 	</spring:bind>
 	
 	<table class="formTable">
 		<tr>
 			<c:if test="${isCodeGenerated}">
 				<th><fmt:message key="entity.invoice.code" /></th>
 				<td>
 					${invoiceForm.code}
 					<spring:bind path="invoiceForm.code">
-						<input type="hidden" name="${status.expression}" value="${status.value}" />
+						<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 					</spring:bind>
 				</td>
 			</c:if>
 
 			<c:if test="${!isCodeGenerated}">
 			<spring:bind path="invoiceForm.code">
 				<th><fmt:message key="entity.invoice.code" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
@@ -35,11 +35,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="invoiceForm.orderDate">
 				<th><fmt:message key="entity.invoice.orderDate" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceOrderDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceOrderDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceOrderDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('invoiceOrderDateId','invoiceOrderDateImgId');
 					// -->
@@ -52,11 +52,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="invoiceForm.finishDate">
 				<th><fmt:message key="entity.invoice.finishDate" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceFinishDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceFinishDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFinishDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('invoiceFinishDateId','invoiceFinishDateImgId');
 					// -->
@@ -69,11 +69,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="invoiceForm.name">
 				<th><fmt:message key="entity.invoice.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceList.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceList.jsp
index f161e69..bc8e481 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceList.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceList.jsp
@@ -12,21 +12,21 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="entity.invoice.orderDateFrom" /></th>
 			<td>
-				<input type="text" name="invoiceFilterOrderDateFrom" value="${invoiceFilterOrderDateFrom}" tabindex="1" id="invoiceFilterOrderDateFromId"/><%--
+				<input type="text" name="invoiceFilterOrderDateFrom" value="${fn:escapeXml(invoiceFilterOrderDateFrom)}" tabindex="1" id="invoiceFilterOrderDateFromId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFilterOrderDateFromImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('invoiceFilterOrderDateFromId','invoiceFilterOrderDateFromImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="entity.invoice.employee" /></th>
 			<td>
-				<vc:select name="invoiceFilterEmployee" valueObjects="${employees}" selected="${invoiceFilterEmployee}" 
+				<vc:select name="invoiceFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(invoiceFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="2">
 					<vc:select-option value="-1">--- <fmt:message key="invoice.allEmployees" /> ---</vc:select-option>
 				</vc:select> 
 			</td>
@@ -35,11 +35,11 @@
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.orderDateTo" /></th>
 			<td>
-				<input type="text" name="invoiceFilterOrderDateTo" value="${invoiceFilterOrderDateTo}" tabindex="1" id="invoiceFilterOrderDateToId"/><%--
+				<input type="text" name="invoiceFilterOrderDateTo" value="${fn:escapeXml(invoiceFilterOrderDateTo)}" tabindex="1" id="invoiceFilterOrderDateToId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFilterOrderDateToImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('invoiceFilterOrderDateToId','invoiceFilterOrderDateToImgId');
 				// -->
@@ -63,27 +63,27 @@
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.finishDateFrom" /></th>
 			<td>
-				<input type="text" name="invoiceFilterFinishDateFrom" value="${invoiceFilterFinishDateFrom}" tabindex="1" id="invoiceFilterFinishDateFromId"/><%--
+				<input type="text" name="invoiceFilterFinishDateFrom" value="${fn:escapeXml(invoiceFilterFinishDateFrom)}" tabindex="1" id="invoiceFilterFinishDateFromId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFilterFinishDateFromImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('invoiceFilterFinishDateFromId','invoiceFilterFinishDateFromImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="entity.invoice.code" /></th>
 			<td>
-				<input type="text" name="invoiceFilterCode" value="${invoiceFilterCode}" maxlength="30"/>
+				<input type="text" name="invoiceFilterCode" value="${fn:escapeXml(invoiceFilterCode)}" maxlength="30"/>
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.finishDateTo" /></th>
 			<td>
-				<input type="text" name="invoiceFilterFinishDateTo" value="${invoiceFilterFinishDateTo}" tabindex="1" id="invoiceFilterFinishDateToId"/><%--
+				<input type="text" name="invoiceFilterFinishDateTo" value="${fn:escapeXml(invoiceFilterFinishDateTo)}" tabindex="1" id="invoiceFilterFinishDateToId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="invoiceFilterFinishDateToImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('invoiceFilterFinishDateToId','invoiceFilterFinishDateToImgId');
 				// -->
@@ -105,17 +105,17 @@
 	<display:setProperty name="export.xml.filename" value="${employee.user.contactInfo.displayName}-invoice.xml" />
 	<display:setProperty name="export.pdf.filename" value="${employee.user.contactInfo.displayName}-invoice.pdf" />
 	<display:setProperty name="export.rtf.filename" value="${employee.user.contactInfo.displayName}-invoice.rtf" />
 	
 	<!-- data columns -->
-	<display:column property="orderDate" titleKey="entity.invoice.orderDate" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
+	<display:column property="orderDate" titleKey="entity.invoice.orderDate" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator"/>
 	<display:column property="finishDate" titleKey="entity.invoice.finishDate" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
-	<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10"/> 
-	<display:column property="name" titleKey="entity.invoice.name" sortable="true" />
-	<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee"/>
-	<display:column property="employee.user.login.ldapLogin" titleKey="entity.invoice.employee.ldaplogin" media="csv excel xml pdf rtf" />
+	<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10" escapeXml="true" /> 
+	<display:column property="name" titleKey="entity.invoice.name" sortable="true" escapeXml="true" />
+	<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee" escapeXml="true" />
+	<display:column property="employee.user.login.ldapLogin" titleKey="entity.invoice.employee.ldaplogin" media="csv excel xml pdf rtf" escapeXml="true"/>
 	
 	<display:column property="state" titleKey="entity.invoice.state" media="html" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.StateDecorator" maxLength="5" class="center"/>
 	<display:column titleKey="entity.invoice.state" media="csv excel xml pdf rtf">
 		<fmt:message key="invoice.state.${invoice.state}" />
 	</display:column>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/InvoiceView.jsp b/src/main/webapp/WEB-INF/jsp/retra/InvoiceView.jsp
index 6cd55fa..4229306 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/InvoiceView.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/InvoiceView.jsp
@@ -6,11 +6,11 @@
 
 <form action="${requestURI}" method="post" >
 	<table class="formTable">
 		<tr>
 			<th><fmt:message key="entity.invoice.code" /></th>
-			<td>${invoice.code}</td>
+			<td>${fn:escapeXml(invoice.code)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.orderDate" /></th>
 			<td><fmt:formatDate pattern="${TypeFormats.DATE_FORMAT}" value="${invoice.orderDate}" /></td>
 		</tr>
@@ -18,15 +18,15 @@
 			<th><fmt:message key="entity.invoice.finishDate" /></th>
 			<td><fmt:formatDate pattern="${TypeFormats.DATE_FORMAT}" value="${invoice.finishDate}" /></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.employee" /></th>
-			<td>${invoice.employee.user.contactInfo.displayName}</td>
+			<td>${fn:escapeXml(invoice.employee.user.contactInfo.displayName)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.name" /></th>
-			<td>${invoice.name}</td>
+			<td>${fn:escapeXml(invoice.name)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.invoice.state" /></th>
 			<td><img src="${imgRoot}/<fmt:message key='invoice.state.img.${invoice.state}' />" alt="<fmt:message key='invoice.state.${invoice.state}' />" title="<fmt:message key='invoice.state.${invoice.state}' />" align="absmiddle" /></td>
 		</tr>
@@ -67,33 +67,33 @@
 		<display:setProperty name="export.rtf.filename" value="${invoice.code}-worklog.rtf" />
 		
 		<!-- data columns -->
 		<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 	
-		<display:column titleKey="worklog.project" media="html" >
+		<display:column titleKey="worklog.project" media="html">
 			<!-- this is hack for sorting -->
-			<span class="invisible">${worklog.project.code}</span>
-			<acronym title="${worklog.project.name}">${worklog.project.code}</acronym>
+			<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+			<acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym>
 		</display:column>
-		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true"/>
 	
 		<display:column titleKey="worklog.component" media="html">
 			<!-- this is hack for sorting -->
-			<span class="invisible">${worklog.component.code}</span>
-			<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
+			<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
+			<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
 		</display:column>
-		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf"/>
+		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf" escapeXml="true"/>
 		
 		<display:column titleKey="worklog.activity" media="html">
 			<!-- this is hack for sorting -->
-			<span class="invisible">${worklog.activity.code}</span>
-			<acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym>
+			<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+			<acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym>
 		</display:column>
-		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
+		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true"/>
 
 		<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true"/>
 
 		<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 		<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 		<display:column property="hours" titleKey="worklog.hours" format="{0,number,#,##0.00}" total="true"/>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ProjectCreate.jsp b/src/main/webapp/WEB-INF/jsp/retra/ProjectCreate.jsp
index 28f3a53..5fc7548 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ProjectCreate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ProjectCreate.jsp
@@ -8,11 +8,11 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="projectForm.parentPk">
 				<th><fmt:message key="entity.project.parent" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -20,33 +20,33 @@
 		</tr>	
 		<tr>
 			<spring:bind path="projectForm.code">
 				<th><fmt:message key="entity.project.code" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="projectForm.name">
 				<th><fmt:message key="entity.project.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>		
 		<tr>
 			<spring:bind path="projectForm.category">
 				<th><fmt:message key="entity.project.category" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 						<vc:select-option value=""><fmt:message key="project.category.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -56,11 +56,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="projectForm.estimation">
 				<th><fmt:message key="entity.project.estimation" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="15" size="10" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="15" size="10" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ProjectEdit.jsp b/src/main/webapp/WEB-INF/jsp/retra/ProjectEdit.jsp
index fcff2c1..7544c82 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ProjectEdit.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ProjectEdit.jsp
@@ -6,19 +6,19 @@
 
 <c:set var="requestURI" value="ProjectEdit.do?fkprm=true" />
 
 <form action="${requestURI}" method="post" >
 		<spring:bind path="projectForm.pk">
-				<input type="hidden" name="${status.expression}" value="${status.value}" />
+				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 		</spring:bind>
 	
 	<table class="formTable">
 		<tr>
 			<spring:bind path="projectForm.parentPk">
 				<th><fmt:message key="entity.project.parent" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -26,33 +26,33 @@
 		</tr>	
 		<tr>
 			<spring:bind path="projectForm.code">
 				<th><fmt:message key="entity.project.code" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>
 		<tr>
 			<spring:bind path="projectForm.name">
 				<th><fmt:message key="entity.project.name" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"  size="75"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"  size="75"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
 		</tr>		
 		<tr>
 			<spring:bind path="projectForm.category">
 				<th><fmt:message key="entity.project.category" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 						<vc:select-option value=""><fmt:message key="project.category.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -62,11 +62,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="projectForm.estimation">
 				<th><fmt:message key="entity.project.estimation" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" maxlength="15" size="10" />
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="15" size="10" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
@@ -101,11 +101,11 @@
                    </c:if>
 
                </c:forEach>
            <option value="${employee.pk}"
              <c:if test="${selected}">selected="selected"</c:if>>
-               ${employee.user.contactInfo.displayName}
+               ${fn:escapeXml(employee.user.contactInfo.displayName)}
            </option>
            <c:remove var="selected"/>
          </c:forEach>
        </select>
        <c:forEach items="${status.errorMessages}">
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ProjectManageComponents.jsp b/src/main/webapp/WEB-INF/jsp/retra/ProjectManageComponents.jsp
index e651a50..16c6f33 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ProjectManageComponents.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ProjectManageComponents.jsp
@@ -4,29 +4,29 @@
 
 <c:set var="requestURI" value="ProjectManageComponents.do?fkprm=true" />
 
 <form action="${requestURI}" method="post" >
 		<spring:bind path="projectForm.pk">
-				<input type="hidden" name="${status.expression}" value="${status.value}" />
+				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
 		</spring:bind>
 		
 		<table class="formTable">
 		<tr>
 			<th><fmt:message key="entity.project.code" /></th>
-			<td>${projectForm.code}</td>
+			<td>${fn:escapeXml(projectForm.code)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.project.name" /></th>
-			<td>${projectForm.name}</td>
+			<td>${fn:escapeXml(projectForm.name)}</td>
 		</tr>
 		
 	</table>
 	
 	<display:table name="${projectForm.components}" requestURI="${requestURI}" defaultsort="1" pagesize="${defaultPageSize}" id="component"
 		sort="list">
-		<display:column property="code" titleKey="entity.component.code" sortable="true" />
-		<display:column property="name" titleKey="entity.component.name" sortable="true" />
+		<display:column property="code" titleKey="entity.component.code" sortable="true" escapeXml="true" />
+		<display:column property="name" titleKey="entity.component.name" sortable="true" escapeXml="true" />
 		
 		<display:column url="/ComponentEdit.do?fkprm=true" paramId="pk" paramProperty="pk" media="html" class="action"  headerClass="action" 
 			titleKey="action.edit">
 			<%-- 
 			titleKey="projectManagement.editComponent.action">
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ProjectManagement.jsp b/src/main/webapp/WEB-INF/jsp/retra/ProjectManagement.jsp
index a02e438..dfbeda2 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ProjectManagement.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ProjectManagement.jsp
@@ -11,25 +11,25 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="entity.project.code" /></th>
 			<td>
-				<input type="text" name="projectFilterCode" value="${projectFilterCode}" maxlength="30"/>
+				<input type="text" name="projectFilterCode" value="${fn:escapeXml(projectFilterCode)}" maxlength="30"/>
 			</td>
 			<th><fmt:message key="entity.project.employee" /></th>
 			<td>
-				<vc:select name="projectFilterEmployee" valueObjects="${employees}" selected="${projectFilterEmployee}" 
+				<vc:select name="projectFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(projectFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="2">
 					<vc:select-option value="-1">--- <fmt:message key="project.allEmployees" /> ---</vc:select-option>
 				</vc:select> 
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.project.name" /></th>
 			<td>
-				<input type="text" name="projectFilterName" value="${projectFilterName}" maxlength="255"/>
+				<input type="text" name="projectFilterName" value="${fn:escapeXml(projectFilterName)}" maxlength="255"/>
 			</td>
 			<th><fmt:message key="entity.project.state" /></th>
 			<td>
 				<select name="projectFilterState">
 					<option value="-1">--- <fmt:message key="state.all" /> ---</option>
@@ -53,15 +53,15 @@
 	</div>
 </form>
 
 <display:table name="projects" requestURI="${requestURI}" defaultsort="1" pagesize="${defaultPageSize}" id="project" sort="list">
 
-	<display:column property="parent.code" titleKey="entity.project.parent.code" sortable="true" maxLength="10"/>
-	<display:column property="code" titleKey="entity.project.code" sortable="true" maxLength="10"/> 
-	<display:column property="name" titleKey="entity.project.name" sortable="true" />
-	<display:column property="estimation" titleKey="entity.project.estimation" sortable="true" />
-	<display:column property="category.code" titleKey="entity.project.category" sortable="true" />
+	<display:column property="parent.code" titleKey="entity.project.parent.code" sortable="true" maxLength="10" escapeXml="true" />
+	<display:column property="code" titleKey="entity.project.code" sortable="true" maxLength="10" escapeXml="true" /> 
+	<display:column property="name" titleKey="entity.project.name" sortable="true"  escapeXml="true"/>
+	<display:column property="estimation" titleKey="entity.project.estimation" sortable="true" escapeXml="true" />
+	<display:column property="category.code" titleKey="entity.project.category" sortable="true" escapeXml="true" />
 	
 	<display:column property="state" titleKey="entity.project.state" media="html" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.StateDecorator" maxLength="5" class="center"/>
 	<display:column titleKey="entity.project.state" media="csv excel xml pdf rtf">
 		<fmt:message key="state.${project.state}" />
 	</display:column>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ProjectView.jsp b/src/main/webapp/WEB-INF/jsp/retra/ProjectView.jsp
index 4f3175e..a47871d 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ProjectView.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ProjectView.jsp
@@ -7,30 +7,30 @@
 
 <form action="${requestURI}" method="post" >
 	<table class="formTable">
 		<tr>
 			<th><fmt:message key="entity.project.parent.code" /></th>
-			<td>${project.parent.code}</td>
+			<td>${fn:escapeXml(project.parent.code)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.project.code" /></th>
-			<td>${project.code}</td>
+			<td>${fn:escapeXml(project.code)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.project.name" /></th>
-			<td>${project.name}</td>
+			<td>${fn:escapeXml(project.name)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.project.category" /></th>
 			<td>
-				<c:if test="${project.category != null}" >${project.category.code} - ${project.category.name}</c:if>
+				<c:if test="${project.category != null}" >${fn:escapeXml(project.category.code)} - ${fn:escapeXml(project.category.name)}</c:if>
 				<c:if test="${project.category == null}" >-</c:if>
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="entity.project.estimation" /></th>
-			<td>${project.estimation}</td>
+			<td>${fn:escapeXml(project.estimation)}</td>
 		</tr>		
 		<tr>
 			<th><fmt:message key="entity.project.workEnabled" /></th>
 			<td>
 				<c:choose>
@@ -50,11 +50,11 @@
 	
 	<br><center><b>Employees</b></center>
 	
 	<display:table name="project.employees" requestURI="${requestURI}" defaultsort="1" pagesize="${defaultPageSize}" id="employee"
 		sort="list">
-		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true"/>
+		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" escapeXml="true" />
 	</display:table>	
 	
 	<table class="formTable">
 		<tr class="buttons">
 			<td>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ScheduleCopy.jsp b/src/main/webapp/WEB-INF/jsp/retra/ScheduleCopy.jsp
index 2e622fe..19b3bf6 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ScheduleCopy.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ScheduleCopy.jsp
@@ -4,19 +4,19 @@
 
 <c:set var="requestURI" value="ScheduleCopy.do?fkprm=true" />
 
 <form action="${requestURI}" method="post" >
 	<spring:bind path="scheduleForm.pk">
-		<td><input type="hidden" name="${status.expression}" value="${status.value}" /></td>
+		<td><input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" /></td>
 	</spring:bind>
 	
 	<table class="formTable">
 		<tr>
 			<spring:bind path="scheduleForm.date">
 				<th><fmt:message key="schedule.copyFrom" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleCopyFromId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleCopyFromId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleCopyFromImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('scheduleCopyFromId','scheduleCopyFromImgId');
 					// -->
@@ -29,11 +29,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.copyDestinationFrom">
 				<th><fmt:message key="scheduleForm.copyDestinationFrom" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleCopyDestinationFromId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleCopyDestinationFromId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleCopyDestinationFromImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('scheduleCopyDestinationFromId','scheduleCopyDestinationFromImgId');
 					// -->
@@ -46,11 +46,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.copyDestinationTo">
 				<th><fmt:message key="scheduleForm.copyDestinationTo" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleCopyDestinationToId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleCopyDestinationToId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleCopyDestinationToImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('scheduleCopyDestinationToId','scheduleCopyDestinationToImgId');
 					// -->
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ScheduleCreate.jsp b/src/main/webapp/WEB-INF/jsp/retra/ScheduleCreate.jsp
index 374cf86..129cb0f 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ScheduleCreate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ScheduleCreate.jsp
@@ -8,11 +8,11 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="scheduleForm.date">
 				<th><fmt:message key="schedule.date" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('scheduleDateId','scheduleDateImgId');
 					// -->
@@ -25,11 +25,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.type">
 				<th><fmt:message key="schedule.type" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${types}" selected="${status.value}"
+					<vc:select name="${status.expression}" valueObjects="${types}" selected="${fn:escapeXml(status.value)}"
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -37,11 +37,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.workFrom">
 				<th><fmt:message key="schedule.workFrom" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleWorkFromId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleWorkFromId"/><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="scheduleWorkFromImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('scheduleWorkFromId','scheduleWorkFromImgId');
 					// -->
@@ -54,11 +54,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.workTo">
 				<th><fmt:message key="schedule.workTo" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleWorkToId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleWorkToId"/><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="scheduleWorkToImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('scheduleWorkToId','scheduleWorkToImgId');
 					// -->
@@ -71,11 +71,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.comment">
 				<th><fmt:message key="schedule.comment" /></th>
 				<td>
-					<textarea name="${status.expression}" cols="40" rows="5" >${status.value}</textarea>
+					<textarea name="${status.expression}" cols="40" rows="5" >${fn:escapeXml(status.value)}</textarea>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ScheduleEdit.jsp b/src/main/webapp/WEB-INF/jsp/retra/ScheduleEdit.jsp
index b788d3d..01bff93 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ScheduleEdit.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ScheduleEdit.jsp
@@ -4,19 +4,19 @@
 
 <c:set var="requestURI" value="ScheduleEdit.do?fkprm=true" />
 
 <form action="${requestURI}" method="post" >
 	<spring:bind path="scheduleForm.pk">
-		<td><input type="hidden" name="${status.expression}" value="${status.value}" /></td>
+		<td><input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" /></td>
 	</spring:bind>
 	
 	<table class="formTable">
 		<tr>
 			<spring:bind path="scheduleForm.date">
 				<th><fmt:message key="schedule.date" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('scheduleDateId','scheduleDateImgId');
 					// -->
@@ -29,11 +29,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.type">
 				<th><fmt:message key="schedule.type" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${types}" selected="${status.value}"
+					<vc:select name="${status.expression}" valueObjects="${types}" selected="${fn:escapeXml(status.value)}"
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -58,11 +58,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.workTo">
 				<th><fmt:message key="schedule.workTo" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleWorkToId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleWorkToId"/><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="scheduleWorkToImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('scheduleWorkToId','scheduleWorkToImgId');
 					// -->
@@ -75,11 +75,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="scheduleForm.comment">
 				<th><fmt:message key="schedule.comment" /></th>
 				<td>
-					<textarea name="${status.expression}" cols="40" rows="5" >${status.value}</textarea>
+					<textarea name="${status.expression}" cols="40" rows="5" >${fn:escapeXml(status.value)}</textarea>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ScheduleList.jsp b/src/main/webapp/WEB-INF/jsp/retra/ScheduleList.jsp
index 2fd8ed6..84a97c7 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ScheduleList.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ScheduleList.jsp
@@ -9,51 +9,51 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="schedule.workFrom" /></th>
 			<td>
-				<input type="text" name="scheduleFilterFrom" value="${scheduleFilterFrom}" tabindex="1" id="scheduleFilterWorkFromId"/><%--
+				<input type="text" name="scheduleFilterFrom" value="${fn:escapeXml(scheduleFilterFrom)}" tabindex="1" id="scheduleFilterWorkFromId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleFilterWorkFromImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('scheduleFilterWorkFromId','scheduleFilterWorkFromImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="schedule.employee" /></th>
 			<td>
-				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${scheduleFilterEmployee}" 
+				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(scheduleFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 			<td rowspan="3" class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="6"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="schedule.workTo" /></th>
 			<td>
-				<input type="text" name="scheduleFilterTo" value="${scheduleFilterTo}" tabindex="2" id="scheduleFilterWorkToId"/><%--
+				<input type="text" name="scheduleFilterTo" value="${fn:escapeXml(scheduleFilterTo)}" tabindex="2" id="scheduleFilterWorkToId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="scheduleFilterWorkToImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('scheduleFilterWorkToId','scheduleFilterWorkToImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="schedule.type" /></th>
 			<td>
-				<vc:select name="scheduleFilterType" valueObjects="${types}" selected="${scheduleFilterType}"
+				<vc:select name="scheduleFilterType" valueObjects="${types}" selected="${fn:escapeXml(scheduleFilterType)}"
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="schedule.allTypes" /> ---</vc:select-option>
 				</vc:select>
 			</td>
 		</tr>
 		<tr>
 			<td colspan="2"></td>
 			<th><fmt:message key="schedule.state" /></th>
 			<td>
-				<vc:select name="scheduleFilterState" valueObjects="${scheduleStates}" selected="${scheduleFilterState}"
+				<vc:select name="scheduleFilterState" valueObjects="${scheduleStates}" selected="${fn:escapeXml(scheduleFilterState)}"
 				valueProperty="value" labelProperty="label" orderBy="label"
 				tabindex="5">
 					<vc:select-option value="">--- <fmt:message key="schedule.allStates" /> ---</vc:select-option>
 				</vc:select>
 			</td>
@@ -79,17 +79,17 @@
 	<display:column property="workFrom" titleKey="schedule.workFrom" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="workTo" titleKey="schedule.workTo" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 
 	<display:column titleKey="schedule.type" sortable="true" media="html">
 		<!-- this is hack for sorting -->
-		<span class="invisible">${schedule.type.code}</span>
-		<span title="${schedule.type.name}">${schedule.type.code}</span>
+		<span class="invisible">${fn:escapeXml(schedule.type.code)}</span>
+		<span title="${fn:escapeXml(schedule.type.name)}">${fn:escapeXml(schedule.type.code)}</span>
 	</display:column>
-	<display:column property="type.code" titleKey="schedule.type" sortable="true" media="csv excel xml pdf rtf"/>
+	<display:column property="type.code" titleKey="schedule.type" sortable="true" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column titleKey="schedule.state" sortable="true">
-		<fmt:message key="schedule.state.${schedule.state}"/>
+		<fmt:message key="schedule.state.${fn:escapeXml(schedule.state)}"/>
 	</display:column>
 
 	<display:column property="createdOn" titleKey="schedule.createdOn" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 	<display:column property="changedOn" titleKey="schedule.changedOn" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ScheduleOverviewList.jsp b/src/main/webapp/WEB-INF/jsp/retra/ScheduleOverviewList.jsp
index e2c29c1..9db40d1 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ScheduleOverviewList.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ScheduleOverviewList.jsp
@@ -9,25 +9,25 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="schedule.month" /></th>
 			<td>
-				<vc:select name="scheduleFilterMonth" valueObjects="${months}" selected="${scheduleFilterMonth}"
+				<vc:select name="scheduleFilterMonth" valueObjects="${months}" selected="${fn:escapeXml(scheduleFilterMonth)}"
 				valueProperty="value" labelProperty="label" orderBy="label" tabindex="1" />
 			</td>
 			<th><fmt:message key="schedule.employee" /></th>
 			<td>
-				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${scheduleFilterEmployee}" 
+				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(scheduleFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="2" /> 
 			</td>
 			<td rowspan="2" class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="4"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="schedule.year" /></th>
 			<td>
-				<vc:select name="scheduleFilterYear" valueObjects="${years}" selected="${scheduleFilterYear}"
+				<vc:select name="scheduleFilterYear" valueObjects="${years}" selected="${fn:escapeXml(scheduleFilterYear)}"
 				valueProperty="value" labelProperty="label" orderBy="label" tabindex="3" />
 			</td>
 			<td colspan="2"></td>
 		</tr>
 	</table>
@@ -42,11 +42,11 @@
 	<display:setProperty name="export.xml.filename" value="${employee.user.contactInfo.displayName}-schedule.xml" />
 	<display:setProperty name="export.pdf.filename" value="${employee.user.contactInfo.displayName}-schedule.pdf" />
 	<display:setProperty name="export.rtf.filename" value="${employee.user.contactInfo.displayName}-schedule.rtf" />
 
 	<!-- header -->
-	<display:caption>${employee.user.contactInfo.displayName} - <fmt:message key="month.${scheduleFilterMonth}"/> ${scheduleFilterYear}</display:caption>
+	<display:caption>${fn:escapeXml(employee.user.contactInfo.displayName)} - <fmt:message key="month.${fn:escapeXml(scheduleFilterMonth)}"/> ${fn:escapeXml(scheduleFilterYear)}</display:caption>
 	
 	<!-- data columns -->
 	<display:column property="monday" titleKey="day.2" decorator="cz.softinel.retra.core.utils.decorator.ScheduleOverviewDecorator" class="day ${scheduleOverview.monday.cssClass}" headerClass="day" media="html" />
 	<display:column property="tuesday" titleKey="day.3" decorator="cz.softinel.retra.core.utils.decorator.ScheduleOverviewDecorator" class="day ${scheduleOverview.tuesday.cssClass}" headerClass="day" media="html" />
 	<display:column property="wednesday" titleKey="day.4" decorator="cz.softinel.retra.core.utils.decorator.ScheduleOverviewDecorator" class="day ${scheduleOverview.wednesday.cssClass}" headerClass="day" media="html" />
@@ -67,11 +67,11 @@
 
 <div class="printer invisibleInPrint"">
 	<table class="invisibleInPrint" width="100%">
 		<tr>
 			<td class="center scheduleDefault"><fmt:message key="schedule.default" /></td>
-			<c:forEach items="${types}" var="type"><td class="center ${type.cssClass}">${type.name}</td></c:forEach>
+			<c:forEach items="${types}" var="type"><td class="center ${type.cssClass}">${fn:escapeXml(type.name)}</td></c:forEach>
 			<td class="center scheduleWeekend"><fmt:message key="schedule.weekend.holidays" /></td>
 		</tr>
 	</table>
 </div>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/ScheduleView.jsp b/src/main/webapp/WEB-INF/jsp/retra/ScheduleView.jsp
index 0091416..850e2d9 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/ScheduleView.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/ScheduleView.jsp
@@ -1,10 +1,10 @@
 <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
 
 <%@ include file="../Includes.jsp"%>
 
-<c:set var="requestURI" value="ScheduleList.do?fkprm=true&scheduleFilterEmployee=${schedule.employee.pk}" />
+<c:set var="requestURI" value="ScheduleList.do?fkprm=true&scheduleFilterEmployee=${fn:escapeXml(schedule.employee.pk)}" />
 
 <form action="${requestURI}" method="post" >
 	<table class="formTable">
 		<tr>
 			<th><fmt:message key="schedule.date" /></th>
@@ -26,11 +26,11 @@
 			<th><fmt:message key="schedule.workTo" /></th>
 			<td><fmt:formatDate pattern="${TypeFormats.HOUR_FORMAT}" value="${schedule.workTo}" /></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="schedule.comment" /></th>
-			<td>${schedule.comment}</td>
+			<td>${fn:escapeXml(schedule.comment)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="schedule.createdOn" /></th>
 			<td><fmt:formatDate pattern="${TypeFormats.DATE_FORMAT_WITH_HOURS_MINUTES_SECONDS}" value="${schedule.createdOn}" /></td>
 		</tr>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogCreate.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogCreate.jsp
index f7d2fa1..d8b6354 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogCreate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogCreate.jsp
@@ -13,11 +13,11 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="worklogForm.date">
 				<th><fmt:message key="worklog.date" /></th>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('worklogDateId','worklogDateImgId');
 					// -->
@@ -31,11 +31,11 @@
 		<tr>
 			<spring:bind path="worklogForm.project">
 				<th><fmt:message key="worklog.project" /></th>
 				<td colspan="2">
 					<!-- valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk" />  -->
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk" onchange="worklogProjectChange()" id="worklogProjectId" /> 
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -43,11 +43,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.component">
 				<th><fmt:message key="worklog.component" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${components}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${components}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"
 					>
 						<vc:select-option value=""><fmt:message key="worklog.component.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
@@ -58,11 +58,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.activity">
 				<th><fmt:message key="worklog.activity" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk" id="worklogActivityId" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -70,11 +70,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.invoice">
 				<th><fmt:message key="worklog.invoice" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"
 					>
 						<vc:select-option value=""><fmt:message key="worklog.invoice.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
@@ -85,11 +85,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.workFrom">
 				<th><fmt:message key="worklog.workFrom" /></th>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkFromId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkFromId"/><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="worklogWorkFromImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('worklogWorkFromId','worklogWorkFromImgId');
 					// -->
@@ -102,11 +102,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.workTo">
 				<th><fmt:message key="worklog.workTo" /></th>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkToId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkToId"/><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="worklogWorkToImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('worklogWorkToId','worklogWorkToImgId');
 					// -->
@@ -119,11 +119,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.description">
 				<th><fmt:message key="worklog.description" /></th>
 				<td width="300">
-					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${status.value}</textarea>
+					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${fn:escapeXml(status.value)}</textarea>
 					<script language="javascript" type="text/javascript">
 					<!--
 					function imposeMaxLength(Event, Object, MaxLen)
 					{
 					        return (Object.value.length <= MaxLen)||(Event.keyCode == 8||Event.keyCode==46||(Event.keyCode>=35&&Event.keyCode<=40))
@@ -149,11 +149,11 @@
 		<c:if test="${jiraIntegrationEnabled}" >
 		<tr>
 			<spring:bind path="worklogForm.issueTrackingReference">
 				<td><fmt:message key="worklog.jiraIssue" /></td>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="jiraissue" maxlength="50"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="jiraissue" maxlength="50"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogDaily.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogDaily.jsp
index e703859..457d53f 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogDaily.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogDaily.jsp
@@ -12,21 +12,21 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="worklog.date" /></th>
 			<td>
-				<input type="text" name="worklogFilterDate" value="${worklogFilterDate}" tabindex="1" id="worklogFilterDateId"/><%--
+				<input type="text" name="worklogFilterDate" value="${fn:escapeXml(worklogFilterDate)}" tabindex="1" id="worklogFilterDateId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterDateImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterDateId','worklogFilterDateImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 			<td class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="6"/></td>
 		</tr>
@@ -47,11 +47,11 @@
 	</a>
 	]
 </div>
 
 <table id="worklog" class="listTable">
-	<caption>Daily worklog for ${employee.user.contactInfo.displayName}, ${worklogFilterDate} (<fmt:message key="day.${dayOfWeek}"/>&nbsp;-&nbsp;<span class="${dayOfWeekCss}" title="<fmt:message key="${dayOfWeekTitle}"/>">&nbsp;&nbsp;&nbsp;</span>)</caption>
+	<caption>Daily worklog for ${fn:escapeXml(employee.user.contactInfo.displayName)}, ${fn:escapeXml(worklogFilterDate)} (<fmt:message key="day.${dayOfWeek}"/>&nbsp;-&nbsp;<span class="${dayOfWeekCss}" title="<fmt:message key="${dayOfWeekTitle}"/>">&nbsp;&nbsp;&nbsp;</span>)</caption>
 	<thead>
 		<tr>
 			<th><fmt:message key="worklog.date"/></th>
 			<th><fmt:message key="worklog.workFrom"/></th>
 			<th><fmt:message key="worklog.workTo"/></th>
@@ -98,14 +98,14 @@
 			<tr class="odd">
 				<td><fmt:formatDate value="${worklog.workFrom}" pattern="${TypeFormats.DATE_FORMAT}"/></td>
 				<td><fmt:formatDate value="${worklog.workFrom}" pattern="${TypeFormats.HOUR_FORMAT}"/></td>
 				<td><fmt:formatDate value="${worklog.workTo}" pattern="${TypeFormats.HOUR_FORMAT}"/></td>
 				<td>${worklog.descriptionGui}</td>
-				<td><acronym title="${worklog.project.name}">${worklog.project.code}</acronym></td>
-				<td><acronym title="${worklog.component.name}">${worklog.component.code}</acronym></td>
-				<td><acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym></td>
-				<td class="nowrap"><acronym title="${worklog.invoice.name}">${worklog.invoice.code}</acronym><c:if test="${worklog.invoice != null}">&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/></c:if></td>
+				<td><acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym></td>
+				<td><acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym></td>
+				<td><acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym></td>
+				<td class="nowrap"><acronym title="${fn:escapeXml(worklog.invoice.name)}">${fn:escapeXml(worklog.invoice.code)}</acronym><c:if test="${worklog.invoice != null}">&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/></c:if></td>
 				<td><fmt:formatNumber value="${worklog.hours}" maxFractionDigits="2" minFractionDigits="2"/></td>
 				<td class="actions">
 					[ 
 						<a href="WorklogDailyView.do?fkprm=true&worklogPk=${worklog.pk}"><fmt:message key="action.view"/></a>
 <c:if test="${securityContext.loggedEmployee.pk == employee.pk && worklog.editableAccordingToInvoice}">
@@ -122,11 +122,11 @@
 		<c:choose>
 			<c:when test="${empty lastWorklog}">
 				<tr class="even"><td colspan="10">
 					<c:choose>
 						<c:when test="${securityContext.loggedEmployee.pk == employee.pk}">
-							<a href="WorklogDailyCreate.do?fkprm=true&setDate=${worklogFilterDate}">Insert new worklog item</a>
+							<a href="WorklogDailyCreate.do?fkprm=true&setDate=${fn:escapeXml(worklogFilterDate)}">Insert new worklog item</a>
 						</c:when>
 						<c:otherwise>
 							Nothing found to display.
 						</c:otherwise>
 					</c:choose>
@@ -174,11 +174,11 @@
 		</c:forEach>
 		<th><fmt:message key="worklog.total"/></th>
 	</tr>
 	<c:forEach items="${projectProjectionList}" var="project">
 		<tr class="odd">
-			<th>${project.key.code}</th>
+			<th>${fn:escapeXml(project.key.code)}</th>
 			<c:forEach items="${activityProjectionList}" var="activity">
 				<td style='text-align:right;'>
 					<fmt:formatNumber value="${grouppedWorklog.map[project.key][activity.key].sum}" maxFractionDigits="2" minFractionDigits="2" />
 				</td>
 			</c:forEach>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogDailyOverview.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogDailyOverview.jsp
index e7a978b..f66e0a2 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogDailyOverview.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogDailyOverview.jsp
@@ -11,41 +11,41 @@
 		<tr>
 			<th></th>
 			<td></td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 			<td rowspan="3" class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="6"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.date" /></th>
 			<td>
-				<input type="text" name="worklogFilterDate" value="${worklogFilterDate}" tabindex="1" id="worklogFilterDateId"/><%--
+				<input type="text" name="worklogFilterDate" value="${fn:escapeXml(worklogFilterDate)}" tabindex="1" id="worklogFilterDateId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterDateImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterDateId','worklogFilterDateImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.project" /></th>
 			<td>
-				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
+				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 				</vc:select>
 			</td>
 		</tr>
 		<tr>
 			<td colspan="2"></td>
 			<th><fmt:message key="worklog.activity" /></th>
 			<td>
-				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
+				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 					<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 				</vc:select> <!-- tabindex="5" -->
 			</td>
 		</tr>
@@ -71,24 +71,24 @@
 	<!-- data columns -->
 	<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
 	<display:column titleKey="worklog.project" media="html" >
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.project.code}</span>
-		<span title="${worklog.project.name}">${worklog.project.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
 	</display:column>
-	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column titleKey="worklog.activity" media="html">
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.activity.code}</span>
-		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
 	</display:column>
-	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
+	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
 
-	<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+	<display:column property="descriptionGui" titleKey="worklog.description" media="html" escapeXml="true" />	
+	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true "/>
 
 	<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="hours" titleKey="worklog.hours" sortable="true" format="{0,number,#,##0.00}"/>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogEdit.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogEdit.jsp
index 3702a88..ea37c91 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogEdit.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogEdit.jsp
@@ -9,19 +9,19 @@
 <!-- TODO sigl: this is only temporary solution -->
 <jsp:include page="WorkWithHistoryData.jsp?requestURI=${requestURI}&worklogPk=${param.worklogPk}" />
 
 <form action="${requestURI}" method="post" >
 	<spring:bind path="worklogForm.pk">
-		<td><input type="hidden" name="${status.expression}" value="${status.value}" /></td>
+		<td><input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" /></td>
 	</spring:bind>
 	
 	<table class="formTable">
 		<tr>
 			<spring:bind path="worklogForm.date">
 				<th><fmt:message key="worklog.date" /></th>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}"  id="worklogDateId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}"  id="worklogDateId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogDateImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('worklogDateId','worklogDateImgId');
 					// -->
@@ -34,11 +34,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.project">
 				<th><fmt:message key="worklog.project" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk" onchange="worklogProjectChange()" id="worklogProjectId" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -46,11 +46,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.component">
 				<th><fmt:message key="worklog.component" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${components}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${components}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"
 					>
 						<vc:select-option value=""><fmt:message key="worklog.component.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
@@ -61,11 +61,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.activity">
 				<th><fmt:message key="worklog.activity" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk" id="worklogActivityId" />
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
@@ -73,11 +73,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.invoice">
 				<th><fmt:message key="worklog.invoice" /></th>
 				<td colspan="2">
-					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"
 					>
 						<vc:select-option value=""><fmt:message key="worklog.invoice.unassigned" /></vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
@@ -88,11 +88,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.workFrom">
 				<th><fmt:message key="worklog.workFrom" /></th>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkFromId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkFromId"/><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="worklogWorkFromImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('worklogWorkFromId','worklogWorkFromImgId');
 					// -->
@@ -105,11 +105,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.workTo">
 				<th><fmt:message key="worklog.workTo" /></th>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkToId" /><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkToId" /><%--
 				--%><img src="${imgRoot}/hoursIco.gif" alt="<fmt:message key='hours.label' />" title="<fmt:message key='hours.label' />" align="top" id="worklogWorkToImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForTime('worklogWorkToId','worklogWorkToImgId');
 					// -->
@@ -122,11 +122,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="worklogForm.description">
 				<th><fmt:message key="worklog.description" /></th>
 				<td width="300">
-					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${status.value}</textarea>
+					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${fn:escapeXml(status.value)}</textarea>
 					<script language="javascript" type="text/javascript">
 					<!--
 					function imposeMaxLength(Event, Object, MaxLen)
 					{
 					        return (Object.value.length <= MaxLen)||(Event.keyCode == 8||Event.keyCode==46||(Event.keyCode>=35&&Event.keyCode<=40))
@@ -152,11 +152,11 @@
 		<c:if test="${jiraIntegrationEnabled}" >
 		<tr>
 			<spring:bind path="worklogForm.issueTrackingReference">
 				<td><fmt:message key="worklog.jiraIssue" /></td>
 				<td colspan="2">
-					<input type="text" name="${status.expression}" value="${status.value}" id="jiraissue" maxlength="50"/>
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="jiraissue" maxlength="50"/>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 				</td>
 			</spring:bind>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogImportConfirm.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogImportConfirm.jsp
index ddf348d..af6b761 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogImportConfirm.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogImportConfirm.jsp
@@ -11,14 +11,14 @@
 			<input type="checkbox" name="confirmedItems" value="${worklog_rowNum}" checked="true" onChange="" />
 		</display:column>		
 		
 		<!-- data columns -->
 		<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
-		<display:column property="project.code" titleKey="worklog.project" />
-		<display:column property="activity.code" titleKey="worklog.activity" />
-		<display:column property="invoice.name" titleKey="workLog.invoice"/>
-		<display:column property="description" titleKey="worklog.description"/>
+		<display:column property="project.code" titleKey="worklog.project" escapeXml="true" />
+		<display:column property="activity.code" titleKey="worklog.activity" escapeXml="true" />
+		<display:column property="invoice.name" titleKey="workLog.invoice" escapeXml="true" />
+		<display:column property="description" titleKey="worklog.description" escapeXml="true" />
 		<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 		<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 		<display:column property="hours" titleKey="worklog.hours" format="{0,number,#,##0.00}"/>
 	</display:table>
 	
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogImportMapping.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogImportMapping.jsp
index cfac30f..d974cea 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogImportMapping.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogImportMapping.jsp
@@ -16,18 +16,18 @@
 
 <c:choose>	<%-- if parser is able to find some external projects present them for mapping otherwise present internal ones for selection only --%>
 	<c:when test="${ not empty form.externalProjects}">
 		<c:forEach var="externalProject" items="${form.externalProjects}" varStatus="status">
 			<tr>
-				<th>${externalProject.name}</th>
+				<th>${fn:escapeXml(externalProject.name)}</th>
 				<td>
-					<vc:select name="externalProjects[${status.index}].projectId" valueObjects="${projects}" selected="${externalProject.projectId}" 
+					<vc:select name="externalProjects[${status.index}].projectId" valueObjects="${projects}" selected="${fn:escapeXml(externalProject.projectId)}" 
 							valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="-1"><fmt:message key="worklog.pleaseSpecify" /></vc:select-option>
 					</vc:select>
 				<c:if test="${showInvoices}">
-					<vc:select name="externalProjects[${status.index}].invoiceId" valueObjects="${invoices}" selected="${externalProject.invoiceId}" 
+					<vc:select name="externalProjects[${status.index}].invoiceId" valueObjects="${invoices}" selected="${fn:escapeXml(externalProject.invoiceId)}" 
 							valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="-1">&nbsp;</vc:select-option>
 					</vc:select>
 				</c:if>	
 				</td>
@@ -53,13 +53,13 @@
 		
 <c:choose> <%-- if parser is able to find some external activities present them for mapping otherwise present internal ones for selection only --%>
 	<c:when test="${ not empty form.externalActivities}">
 		<c:forEach var="externalActivity" items="${form.externalActivities}" varStatus="status">
 			<tr>
-				<th>${externalActivity.name}</th>
+				<th>${fn:escapeXml(externalActivity.name)}</th>
 				<td>
-					<vc:select name="externalActivities[${status.index}].activityId" valueObjects="${activities}" selected="${externalActivity.activityId}" 
+					<vc:select name="externalActivities[${status.index}].activityId" valueObjects="${activities}" selected="${fn:escapeXml(externalActivity.activityId)}"
 							valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="-1"><fmt:message key="worklog.pleaseSpecify" /></vc:select-option>
 					</vc:select>
 				</td>
 			</tr>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairConfirm.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairConfirm.jsp
index c6d26c8..57c9072 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairConfirm.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairConfirm.jsp
@@ -5,19 +5,19 @@
 <c:set var="requestURI" value="${requestURI}" />
 
 <table class="formTable">
 	<tr>
 		<th><fmt:message key="entity.invoice.code" /></th>
-		<td>${invoice.code}</td>
+		<td>${fn:escapeXml(invoice.code)}</td>
 	</tr>
 	<tr>
 		<th><fmt:message key="entity.invoice.employee" /></th>
-		<td>${invoice.employee.user.contactInfo.displayName}</td>
+		<td>${fn:escapeXml(invoice.employee.user.contactInfo.displayName)}</td>
 	</tr>
 	<tr>
 		<th><fmt:message key="entity.invoice.name" /></th>
-		<td>${invoice.name}</td>
+		<td>${fn:escapeXml(invoice.name)}</td>
 	</tr>
 	<tr>
 		<th><fmt:message key="entity.invoice.state" /></th>
 		<td><img src="${imgRoot}/<fmt:message key='invoice.state.img.${invoice.state}' />" alt="<fmt:message key='invoice.state.${invoice.state}' />" title="<fmt:message key='invoice.state.${invoice.state}' />" align="absmiddle" /></td>
 	</tr>
@@ -34,31 +34,31 @@
 		<!-- data columns -->
 		<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
 		<display:column titleKey="worklog.project" media="html" >
 			<!-- this is hack for sorting -->
-			<span class="invisible">${worklog.project.code}</span>
-			<span title="${worklog.project.name}">${worklog.project.code}</span>
+			<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+			<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
 		</display:column>
-		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
 
 		<display:column titleKey="worklog.component" media="html">
 			<!-- this is hack for sorting -->
-			<span class="invisible">${worklog.component.code}</span>
-			<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
+			<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
+			<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
 		</display:column>
-		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf"/>
+		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf" escapeXml="true" />
 			
 		<display:column titleKey="worklog.activity" media="html">
 			<!-- this is hack for sorting -->
-			<span class="invisible">${worklog.activity.code}</span>
-			<span title="${worklog.activity.name}">${worklog.activity.code}</span>
+			<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+			<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
 		</display:column>
-		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
+		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
 
 		<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
 
 		<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 		<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 		<display:column property="hours" titleKey="worklog.hours" format="{0,number,#,##0.00}" total="true"/>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairFilter.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairFilter.jsp
index a5a4b34..cc83ccf 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairFilter.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogInvoicePairFilter.jsp
@@ -22,18 +22,18 @@
 		<tr>
 			<spring:bind path="form.invoice">
 				<th><fmt:message key="worklog.invoice" /></th>
 				<td>
 					<c:if test="${empty invoices}">
-					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 							<vc:select-option value="">--- <fmt:message key="invoice.please.define" /> ---</vc:select-option>
 					</vc:select>
 					</c:if>
 
 					<c:if test="${!empty invoices}">
-					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" />
 					</c:if>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
@@ -47,11 +47,11 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="form.dateFrom">
 				<th><fmt:message key="worklog.workFrom" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogDateFromId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogDateFromId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogDateFromImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('worklogDateFromId','worklogDateFromImgId');
 					// -->
@@ -64,11 +64,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="form.dateTo">
 				<th><fmt:message key="worklog.workTo" /></th>
 				<td>
-					<input type="text" name="${status.expression}" value="${status.value}" id="worklogDateToId"/><%--
+					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogDateToId"/><%--
 				--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogDateToImgId"/>
 					<script type="text/javascript">
 					<!--
 						showMiraCalendarForDate('worklogDateToId','worklogDateToImgId');
 					// -->
@@ -81,11 +81,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="form.project">
 				<th><fmt:message key="worklog.project" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 					</vc:select> 
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -95,11 +95,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="form.activity">
 				<th><fmt:message key="worklog.activity" /></th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 					</vc:select>
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogList.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogList.jsp
index 3197ef9..b40d8ce 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogList.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogList.jsp
@@ -12,39 +12,39 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="worklog.workFrom" /></th>
 			<td>
-				<input type="text" name="worklogFilterFrom" value="${worklogFilterFrom}" tabindex="1" id="worklogFilterWorkFromId"/><%--
+				<input type="text" name="worklogFilterFrom" value="${fn:escapeXml(worklogFilterFrom)}" tabindex="1" id="worklogFilterWorkFromId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterWorkFromImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterWorkFromId','worklogFilterWorkFromImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.workTo" /></th>
 			<td>
-				<input type="text" name="worklogFilterTo" value="${worklogFilterTo}" tabindex="2" id="worklogFilterWorkToId"/><%--
+				<input type="text" name="worklogFilterTo" value="${fn:escapeXml(worklogFilterTo)}" tabindex="2" id="worklogFilterWorkToId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterWorkToImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterWorkToId','worklogFilterWorkToImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.project" /></th>
 			<td>
-				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
+				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 				</vc:select>
 			</td>
@@ -52,11 +52,11 @@
 		</tr>
 		<tr>
 			<td colspan="2"></td>
 			<th><fmt:message key="worklog.activity" /></th>
 			<td>
-				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
+				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 					<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 				</vc:select> <!-- tabindex="5" -->
 			</td>
 			<td></td>
@@ -77,31 +77,31 @@
 	<display:setProperty name="export.excel.filename" value="${employee.user.contactInfo.displayName}-worklog.xls" />
 	<display:setProperty name="export.xml.filename" value="${employee.user.contactInfo.displayName}-worklog.xml" />
 	<display:setProperty name="export.pdf.filename" value="${employee.user.contactInfo.displayName}-worklog.pdf" />
 	<display:setProperty name="export.rtf.filename" value="${employee.user.contactInfo.displayName}-worklog.rtf" />
 	
-	<display:caption>${employee.user.contactInfo.displayName}</display:caption>
+	<display:caption>${fn:escapeXml(employee.user.contactInfo.displayName)}</display:caption>
 	
 	<!-- data columns -->
 	<display:column property="workFrom" titleKey="worklog.date" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
 	<display:column titleKey="worklog.project" sortable="true" media="html" >
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.project.code}</span>
-		<span title="${worklog.project.name}">${worklog.project.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
 	</display:column>
-	<display:column property="project.code" titleKey="worklog.project" sortable="true" media="csv excel xml pdf rtf"/>
+	<display:column property="project.code" titleKey="worklog.project" sortable="true" media="csv excel xml pdf rtf" escapeXml="true"/>
 
 	<display:column titleKey="worklog.activity" sortable="true" media="html">
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.activity.code}</span>
-		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
 	</display:column>
-	<display:column property="activity.code" titleKey="worklog.activity" sortable="true" media="csv excel xml pdf rtf"/>
+	<display:column property="activity.code" titleKey="worklog.activity" sortable="true" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column property="descriptionGui" titleKey="worklog.description" media="html" sortable="true"/>	
-	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true"/>
 	
 	<display:column property="workFrom" titleKey="worklog.workFrom" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="workTo" titleKey="worklog.workTo" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="hours" titleKey="worklog.hours" sortable="true" format="{0,number,#,##0.00}"/>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogMonthlyOverview.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogMonthlyOverview.jsp
index b6a2e4b..322ab8c 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogMonthlyOverview.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogMonthlyOverview.jsp
@@ -9,30 +9,30 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="worklog.month" /></th>
 			<td>
-				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${worklogFilterMonth}"
+				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${fn:escapeXml(worklogFilterMonth)}"
 				valueProperty="value" labelProperty="label" orderBy="label" tabindex="1" />
 			</td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 			<td rowspan="3" class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="6"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.year" /></th>
 			<td>
-				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${worklogFilterYear}"
+				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${fn:escapeXml(worklogFilterYear)}"
 				valueProperty="value" labelProperty="label" orderBy="label" tabindex="3" />
 			</td>
 			<th><fmt:message key="worklog.project" /></th>
 			<td>
-				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
+				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 				</vc:select>
 			</td>
@@ -40,11 +40,11 @@
 		<tr>
 			<th>&nbsp;</th>
 			<td>&nbsp;</td>
 			<th><fmt:message key="worklog.activity" /></th>
 			<td>
-				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
+				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 					<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 				</vc:select> <!-- tabindex="5" -->
 			</td>
 		</tr>
@@ -70,24 +70,24 @@
 	<!-- data columns -->
 	<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
 	<display:column titleKey="worklog.project" media="html" >
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.project.code}</span>
-		<span title="${worklog.project.name}">${worklog.project.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
 	</display:column>
-	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column titleKey="worklog.activity" media="html">
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.activity.code}</span>
-		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
 	</display:column>
-	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
+	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="hours" titleKey="worklog.hours" sortable="true" format="{0,number,#,##0.00}"/>
 
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogOverview.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogOverview.jsp
index 8225db1..d42cd12 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogOverview.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogOverview.jsp
@@ -12,56 +12,56 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="worklog.workFrom" /></th>
 			<td>
-				<input type="text" name="worklogFilterFrom" value="${worklogFilterFrom}" tabindex="1" id="worklogFilterWorkFromId"/><%--
+				<input type="text" name="worklogFilterFrom" value="${fn:escapeXml(worklogFilterFrom)}" tabindex="1" id="worklogFilterWorkFromId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterWorkFromImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterWorkFromId','worklogFilterWorkFromImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 			<td rowspan="4" class="buttons">
 				<input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="8"/>
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.workTo" /></th>
 			<td>
-				<input type="text" name="worklogFilterTo" value="${worklogFilterTo}" tabindex="2" id="worklogFilterWorkToId"/><%--
+				<input type="text" name="worklogFilterTo" value="${fn:escapeXml(worklogFilterTo)}" tabindex="2" id="worklogFilterWorkToId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterWorkToImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterWorkToId','worklogFilterWorkToImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.project" /></th>
 			<td>
-				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
+				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" 
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 				</vc:select>
 			</td>
 		</tr>
 		<tr>			
 			<th><fmt:message key="worklog.invoice.code" /></th>
 			<td>
-				<input type="text" name="worklogFilterInvoiceCode" value="${worklogFilterInvoiceCode}" maxlength="30"/>
+				<input type="text" name="worklogFilterInvoiceCode" value="${fn:escapeXml(worklogFilterInvoiceCode)}" maxlength="30"/>
 			</td>
 			<th><fmt:message key="worklog.activity" /></th>
 			<td>
-				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
+				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 					<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 				</vc:select> <!-- tabindex="5" -->
 			</td>
 		</tr>
@@ -70,14 +70,14 @@
 			<td>
 				<select name="worklogFilterInvoiceRelation">
 					<c:forEach items="${invoiceRelations}" var="relation">
 						<c:choose>
 							<c:when test="${relation.code == worklogFilterInvoiceRelation}">
-								<option value="${relation.code}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
+								<option value="${fn:escapeXml(relation.code)}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
 							</c:when>
 							<c:otherwise>
-								<option value="${relation.code}"><fmt:message key="invoice.relation.${relation.code}" /></option>
+								<option value="${fn:escapeXml(relation.code)}"><fmt:message key="invoice.relation.${relation.code}" /></option>
 							</c:otherwise>
 						</c:choose>
 					</c:forEach>				
 				</select>
 			</td>
@@ -106,11 +106,11 @@
 <c:set var="activityProjection" value="${worklogGroupped.projectionFor[ACTIVITY]}" />
 <c:set var="activityProjectionList" value="${activityProjection.list}" />
 
 	<div class="tabber">
 	
-		<h2 class="visibleOnlyInPrint">${employee.user.contactInfo.displayName}: ${worklogFilterFrom} - ${worklogFilterTo}</h2>
+		<h2 class="visibleOnlyInPrint">${fn:escapeXml(employee.user.contactInfo.displayName)}: ${fn:escapeXml(worklogFilterFrom)} - ${fn:escapeXml(worklogFilterTo)}</h2>
 	
 		<div class="tabbertab">
 			<h2>Worklog Items</h2>
 			
 			<display:table name="worklogs" requestURI="${requestURI}" export="true" id="worklog" varTotals="worklogTotals">
@@ -126,41 +126,41 @@
 				<!-- data columns -->
 				<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 			
 				<display:column titleKey="worklog.project" media="html" >
 					<!-- this is hack for sorting -->
-					<span class="invisible">${worklog.project.code}</span>
-					<acronym title="${worklog.project.name}">${worklog.project.code}</acronym>
+					<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+					<acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym>
 				</display:column>
-				<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+				<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
 
 				<display:column titleKey="worklog.component" media="html">
 					<!-- this is hack for sorting -->
-					<span class="invisible">${worklog.component.code}</span>
-					<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
+					<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
+					<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
 				</display:column>
-				<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf"/>			
+				<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf" escapeXml="true" />			
 
 				<display:column titleKey="worklog.activity" media="html">
 					<!-- this is hack for sorting -->
-					<span class="invisible">${worklog.activity.code}</span>
-					<acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym>
+					<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+					<acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym>
 				</display:column>
 				<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
 
 				<display:column titleKey="worklog.invoice" media="html" class="nowrap">
 					<c:if test="${worklog.invoice != null}">
-						<span class="invisible">${worklog.invoice.code}</span>
-						<acronym title="${worklog.invoice.name}">${worklog.invoice.code}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/>
+						<span class="invisible">${fn:escapeXml(worklog.invoice.code)}</span>
+						<acronym title="${fn:escapeXml(worklog.invoice.name)}">${fn:escapeXml(worklog.invoice.code)}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/>
 					</c:if>
 				</display:column>
-				<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf"/>
+				<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf" escapeXml="true" />
 			
-				<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee"/>
+				<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee" escapeXml="true" />
 			
 				<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-				<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+				<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
 
 				<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 				<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 				<display:column property="hours" titleKey="worklog.hours" total="true" format="{0,number,#,##0.00}"/>
 
@@ -214,11 +214,11 @@
 		<table class="groupTable">
 		  <thead>		
 			<tr>
 				<th>Day \ Project</th>
 				<c:forEach items="${projectProjectionList}" var="project">
-					<th>${project.key}</th>
+					<th>${fn:escapeXml(project.key)}</th>
 				</c:forEach>
 				<th>Hours / day</th>
 			</tr>
 		  </thead>
 			<c:forEach items="${weekProjectionList}" var="week">
@@ -268,12 +268,12 @@
 			<c:forEach items="${week.projectionFor[1].list}" var="day">
 			<c:forEach items="${day.projectionFor[2].list}" var="project">
 			<c:forEach items="${project.projectionFor[3].list}" var="activity">
 				<tr class="even">
 					<th><fmt:formatDate value="${day.key}" pattern="${TypeFormats.DATE_FORMAT_DOW}"/></th>
-					<td>${project.key}</td>
-					<td>${activity.key}</td>
+					<td>${fn:escapeXml(project.key)}</td>
+					<td>${fn:escapeXml(activity.key)}</td>
 					<th style='text-align:right;'><fmt:formatNumber value="${activity.value.sum}" maxFractionDigits="2" minFractionDigits="2" /></th>
 				</tr>
 			</c:forEach>
 			</c:forEach>
 				<tr class="subTotalRow">
@@ -282,11 +282,11 @@
 					<td>&nbsp;</td>
 					<th style='text-align:right;'><fmt:formatNumber value="${day.value.sum}" maxFractionDigits="2" minFractionDigits="2" /></th>
 				</tr>
 			</c:forEach>
 				<tr class="odd totalRow">
-					<th>Week ${week.key}</th>
+					<th>Week ${fn:escapeXml(week.key)}</th>
 					<td>&nbsp;</td>
 					<td>&nbsp;</td>
 					<th style='text-align:right;'><fmt:formatNumber value="${week.value.sum}" maxFractionDigits="2" minFractionDigits="2" /></th>
 				</tr>
 			</c:forEach>
@@ -304,18 +304,18 @@
 		<table class="groupTable">
 		  <thead>
 			<tr>
 				<th>&nbsp;</th>
 				<c:forEach items="${activityProjectionList}" var="activity">
-					<th>${activity.key}</th>
+					<th>${fn:escapeXml(activity.key)}</th>
 				</c:forEach>
 				<th><fmt:message key="worklog.total"/></th>
 			</tr>
 		  </thead>
 			<c:forEach items="${projectProjectionList}" var="project">
 				<tr class="odd">
-					<th>${project.key}</th>
+					<th>${fn:escapeXml(project.key)}</th>
 					<c:forEach items="${activityProjectionList}" var="activity">
 						<td style='text-align:right;'>
 							<fmt:formatNumber value="${worklogGroupped.map[false][false][project.key][activity.key].sum}" maxFractionDigits="2" minFractionDigits="2" />
 						</td>
 					</c:forEach>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogOverviewList.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogOverviewList.jsp
index 25960ec..9dd663d 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogOverviewList.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogOverviewList.jsp
@@ -9,25 +9,25 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="worklog.month" /></th>
 			<td>
-				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${worklogFilterMonth}"
+				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${fn:escapeXml(worklogFilterMonth)}"
 				valueProperty="value" labelProperty="label" orderBy="label" tabindex="1" />
 			</td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="2" /> 
 			</td>
 			<td rowspan="2" class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="4"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.year" /></th>
 			<td>
-				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${worklogFilterYear}"
+				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${fn:escapeXml(worklogFilterYear)}"
 				valueProperty="value" labelProperty="label" orderBy="label" tabindex="3" />
 			</td>
 			<td colspan="2"></td>
 		</tr>
 	</table>
@@ -42,21 +42,21 @@
 	<display:setProperty name="export.xml.filename" value="${employee.user.contactInfo.displayName}-worklog.xml" />
 	<display:setProperty name="export.pdf.filename" value="${employee.user.contactInfo.displayName}-worklog.pdf" />
 	<display:setProperty name="export.rtf.filename" value="${employee.user.contactInfo.displayName}-worklog.rtf" />
 
 	<!-- header -->
-	<display:caption>${employee.user.contactInfo.displayName} - <fmt:message key="month.${worklogFilterMonth}"/> ${worklogFilterYear}</display:caption>
+	<display:caption>${fn:escapeXml(employee.user.contactInfo.displayName)} - <fmt:message key="month.${worklogFilterMonth}"/> ${fn:escapeXml(worklogFilterYear)}</display:caption>
 	
 	<!-- data columns -->
 	<display:column property="date" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" group="1" class="printBold" />
 
 	<display:column titleKey="worklog.project">
-		${worklog.project.code} - ${worklog.project.name}
+		${fn:escapeXml(worklog.project.codefn:escapeXml)} - ${fn:escapeXml(worklog.project.name)}
 	</display:column>
 
 	<display:column titleKey="worklog.activity">
-		${worklog.activity.code} - ${worklog.activity.name}
+		${fn:escapeXml(worklog.activity.code)} - ${fn:escapeXml(worklog.activity.name)}
 	</display:column>
 
 	<display:column property="hours" titleKey="worklog.hours" total="true" format="{0,number,0.00}"/>
 	
 	<display:footer media="html"><tr><th colspan="3"><fmt:message key="worklog.total" /></th><th><fmt:formatNumber pattern="0.00" >${totals.column4}</fmt:formatNumber></th></tr></display:footer>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogProjectOverview.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogProjectOverview.jsp
index f306336..6ac5b29 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogProjectOverview.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogProjectOverview.jsp
@@ -12,51 +12,51 @@
 	<div class="filter">
 	<table class="filterTable">
 		<tr>
 			<th><fmt:message key="worklog.workFrom" /></th>
 			<td>
-				<input type="text" name="worklogFilterFrom" value="${worklogFilterFrom}" tabindex="1" id="worklogFilterWorkFromId"/><%--
+				<input type="text" name="worklogFilterFrom" value="${fn:escapeXml(worklogFilterFrom)}" tabindex="1" id="worklogFilterWorkFromId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterWorkFromImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterWorkFromId','worklogFilterWorkFromImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.project" /></th>
 			<td>
-				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
+				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName"
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 				</vc:select>
 			</td>
 			<td rowspan="3" class="buttons"><input type="submit" name="filter" class="button" value="<fmt:message key="button.filter"/>" tabindex="6"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.workTo" /></th>
 			<td>
-				<input type="text" name="worklogFilterTo" value="${worklogFilterTo}" tabindex="2" id="worklogFilterWorkToId"/><%--
+				<input type="text" name="worklogFilterTo" value="${fn:escapeXml(worklogFilterTo)}" tabindex="2" id="worklogFilterWorkToId"/><%--
 			--%><img src="${imgRoot}/calendarIco.gif" alt="<fmt:message key='calendar.label' />" title="<fmt:message key='calendar.label' />" align="top" id="worklogFilterWorkToImgId"/>
 				<script type="text/javascript">
 				<!--
 					showMiraCalendarForDate('worklogFilterWorkToId','worklogFilterWorkToImgId');
 				// -->
 				</script>
 			</td>
 			<th><fmt:message key="worklog.activity" /></th>
 			<td>
-				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
+				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName">
 					<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 				</vc:select> <!-- tabindex="5" -->
 			</td>
 		</tr>
 		<tr>			
 			<th><fmt:message key="worklog.invoice.code" /></th>
 			<td>
-				<input type="text" name="worklogFilterInvoiceCode" value="${worklogFilterInvoiceCode}" maxlength="30"/>
+				<input type="text" name="worklogFilterInvoiceCode" value="${fn:escapeXml(worklogFilterInvoiceCode)}" maxlength="30"/>
 			</td>
 			<th></th>
 			<td></td>
 		</tr>
 		<tr>
@@ -64,14 +64,14 @@
 			<td>
 				<select name="worklogFilterInvoiceRelation">
 					<c:forEach items="${invoiceRelations}" var="relation">
 						<c:choose>
 							<c:when test="${relation.code == worklogFilterInvoiceRelation}">
-								<option value="${relation.code}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
+								<option value="${fn:escapeXml(relation.code)}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
 							</c:when>
 							<c:otherwise>
-								<option value="${relation.code}"><fmt:message key="invoice.relation.${relation.code}" /></option>
+								<option value="${fn:escapeXml(relation.code)}"><fmt:message key="invoice.relation.${relation.code}" /></option>
 							</c:otherwise>
 						</c:choose>
 					</c:forEach>				
 				</select>
 			</td>
@@ -87,12 +87,12 @@
 <div class="tabber">
 
 	<div class="tabbertab">
 		<h2>Employee</h2>
 		<display:table id="worklogByEmployeeId" name="worklogByEmployee.list" requestURI="${requestURI}" export="true">
-			<display:column property="key" titleKey="worklog.employee" />
-			<display:column property="keyInfo" titleKey="worklog.employee.ldaplogin" media="csv excel xml pdf rtf"/>			
+			<display:column property="key" titleKey="worklog.employee" escapeXml="true"/>
+			<display:column property="keyInfo" titleKey="worklog.employee.ldaplogin" media="csv excel xml pdf rtf" escapeXml="true" />			
 			<display:column property="value.sum" titleKey="worklog.hours" format="{0,number,#,##0.00}"/>
 			<display:footer media="html">
 				<tr>
 					<th><fmt:message key="worklog.total" /></th>
 					<th><fmt:formatNumber value="${worklogByEmployee.summary.sum}" type="number" maxFractionDigits="2" minFractionDigits="2" /></th>
@@ -102,11 +102,11 @@
 	</div>
 
 	<div class="tabbertab">
 		<h2>Activity</h2>
 		<display:table id="worklogByAcrivityId" name="worklogByAcrivity.list" requestURI="${requestURI}" export="true">
-			<display:column property="key" titleKey="worklog.activity" />
+			<display:column property="key" titleKey="worklog.activity" escapeXml="true" />
 			<display:column property="value.sum" titleKey="worklog.hours" format="{0,number,#,##0.00}" />
 			<display:footer media="html">
 				<tr>
 					<th><fmt:message key="worklog.total" /></th>
 					<th><fmt:formatNumber value="${worklogByAcrivity.summary.sum}" type="number" maxFractionDigits="2" minFractionDigits="2" /></th>
@@ -116,11 +116,11 @@
 	</div>
 
 	<div class="tabbertab">
 		<h2>Project</h2>
 		<display:table id="worklogByProjectId" name="worklogByProject.list" requestURI="${requestURI}" export="true">
-			<display:column property="key" titleKey="worklog.project" />
+			<display:column property="key" titleKey="worklog.project" escapeXml="true" />
 			<display:column property="value.sum" titleKey="worklog.hours" format="{0,number,#,##0.00}" />
 			<display:footer media="html">
 				<tr>
 					<th><fmt:message key="worklog.total" /></th>
 					<th><fmt:formatNumber value="${worklogByProject.summary.sum}" type="number" maxFractionDigits="2" minFractionDigits="2" /></th>
@@ -134,18 +134,18 @@
 		<table class="groupTable">
 		<thead>
 			<tr>
 				<th>&nbsp;</th>
 				<c:forEach items="${worklogGrouppedAcrivity.list}" var="activity">
-					<th>${activity.key}</th>
+					<th>${fn:escapeXml(activity.key)}</th>
 				</c:forEach>
 				<th>Total</th>
 			</tr>
 		</thead>
 			<c:forEach items="${worklogByEmployee.list}" var="employee">
 				<tr class="odd">
-					<th>${employee.key}</th>
+					<th>${fn:escapeXml(employee.key)}</th>
 					<c:forEach items="${worklogGrouppedAcrivity.list}" var="activity">
 						<td style='text-align:right;'>
 							<fmt:formatNumber value="${worklogGroupped.map[employee.key][activity.key][false].sum}" maxFractionDigits="2" minFractionDigits="2" />
 						</td>
 					</c:forEach>
@@ -183,18 +183,18 @@
 		<table class="groupTable">
 		<thead>
 			<tr>
 				<th>&nbsp;</th>
 				<c:forEach items="${projectProjectionList}" var="project">
-					<th>${project.key}</th>
+					<th>${fn:escapeXml(project.key)}</th>
 				</c:forEach>
 				<th><fmt:message key="worklog.total"/></th>
 			</tr>
 		</thead>
 			<c:forEach items="${employeeProjectionList}" var="employee">
 				<tr class="odd">
-					<th>${employee.key}</th>
+					<th>${fn:escapeXml(employee.key)}</th>
 					<c:forEach items="${projectProjectionList}" var="project">
 						<td style='text-align:right;'>
 							<fmt:formatNumber value="${worklogGroupped.map[employee.key][false][project.key].sum}" pattern="#,##0.0#" />
 						</td>
 					</c:forEach>
@@ -216,18 +216,18 @@
 		<table class="groupTable">
 		<thead>
 			<tr>
 				<th>&nbsp;</th>
 				<c:forEach items="${activityProjectionList}" var="activity">
-					<th>${activity.key}</th>
+					<th>${fn:escapeXml(activity.key)}</th>
 				</c:forEach>
 				<th><fmt:message key="worklog.total"/></th>
 			</tr>
 		</thead>
 			<c:forEach items="${projectProjectionList}" var="project">
 				<tr class="odd">
-					<th>${project.key}</th>
+					<th>${fn:escapeXml(project.key)}</th>
 					<c:forEach items="${activityProjectionList}" var="activity">
 						<td style='text-align:right;'>
 							<fmt:formatNumber value="${worklogGroupped.map[false][activity.key][project.key].sum}" maxFractionDigits="2" minFractionDigits="2" />
 						</td>
 					</c:forEach>
@@ -260,41 +260,41 @@
 			<!-- data columns -->
 			<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 		
 			<display:column titleKey="worklog.project" media="html" >
 				<!-- this is hack for sorting -->
-				<span class="invisible">${worklog.project.code}</span>
-				<acronym title="${worklog.project.name}">${worklog.project.code}</acronym>
+				<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+				<acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym>
 			</display:column>
-			<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+			<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
 
 			<display:column titleKey="worklog.component" media="html">
 				<!-- this is hack for sorting -->
-				<span class="invisible">${worklog.component.code}</span>
-				<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
+				<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
+				<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
 			</display:column>
-			<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf"/>
+			<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf" escapeXml="true" />
 		
 			<display:column titleKey="worklog.activity" media="html">
 				<!-- this is hack for sorting -->
-				<span class="invisible">${worklog.activity.code}</span>
-				<acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym>
+				<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+				<acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym>
 			</display:column>
-			<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
+			<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
 		
 			<display:column titleKey="worklog.invoice" media="html" class="nowrap">
 				<c:if test="${worklog.invoice != null}">
-					<span class="invisible">${worklog.invoice.code}</span>
-					<acronym title="${worklog.invoice.name}">${worklog.invoice.code}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="middle"/>
+					<span class="invisible">${fn:escapeXml(worklog.invoice.code)}</span>
+					<acronym title="${fn:escapeXml(worklog.invoice.name)}">${fn:escapeXml(worklog.invoice.code)}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="middle"/>
 				</c:if>
 			</display:column>
-			<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf"/>
+			<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf" escapeXml="true" />
 		
-			<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee"/>
+			<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee" escapeXml="true" />
 		
 			<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-			<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+			<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
 
 			<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 			<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 			<display:column property="hours" titleKey="worklog.hours" format="{0,number,#,##0.00}" total="true"/>
 	
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogView.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogView.jsp
index 9404d8f..5fb5b29 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogView.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogView.jsp
@@ -10,27 +10,27 @@
 			<th><fmt:message key="worklog.date" /></th>
 			<td><fmt:formatDate pattern="${TypeFormats.DATE_FORMAT}" value="${worklog.workFrom}" /></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.project" /></th>
-			<td>${worklog.project.code} - ${worklog.project.name}</td>
+			<td>${fn:escapeXml(worklog.project.code)} - ${fn:escapeXml(worklog.project.name)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.component" /></th>
 			<td>
-				<c:if test="${worklog.component != null}" >${worklog.component.code} - ${worklog.component.name}</c:if>
+				<c:if test="${worklog.component != null}" >${fn:escapeXml(worklog.component.code)} - ${fn:escapeXml(worklog.component.name)}</c:if>
 				<c:if test="${worklog.component == null}" >-</c:if>
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.activity" /></th>
-			<td>${worklog.activity.code} - ${worklog.activity.name}</td>
+			<td>${fn:escapeXml(worklog.activity.code)} - ${fn:escapeXml(worklog.activity.name)}</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.invoice" /></th>
 			<td>
-				<c:if test="${worklog.onInvoice}" >${worklog.invoice.code} (${worklog.invoice.name})&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle" /></c:if>
+				<c:if test="${worklog.onInvoice}" >${fn:escapeXml(worklog.invoice.code)} (${fn:escapeXml(worklog.invoice.name)})&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle" /></c:if>
 				<c:if test="${!worklog.onInvoice}" >-</c:if>
 			</td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.workFrom" /></th>
diff --git a/src/main/webapp/WEB-INF/jsp/retra/WorklogWeeklyOverview.jsp b/src/main/webapp/WEB-INF/jsp/retra/WorklogWeeklyOverview.jsp
index c1e0274..39ef67f 100644
--- a/src/main/webapp/WEB-INF/jsp/retra/WorklogWeeklyOverview.jsp
+++ b/src/main/webapp/WEB-INF/jsp/retra/WorklogWeeklyOverview.jsp
@@ -11,25 +11,25 @@
 		<tr>
 			<th>&nbsp;</th>
 			<td>&nbsp;</td>
 			<th><fmt:message key="worklog.employee" /></th>
 			<td>
-				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
+				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
 				valueProperty="pk" labelProperty="user.contactInfo.displayName" orderBy="user.contactInfo.displayName"
 				tabindex="3" /> 
 			</td>
 			<td rowspan="3" class="buttons"><input type="submit" class="button" name="filter" value="<fmt:message key="button.filter"/>" tabindex="6"/></td>
 		</tr>
 		<tr>
 			<th><fmt:message key="worklog.week" /></th>
 			<td>
-				<vc:select name="worklogFilterWeek" valueObjects="${weeks}" selected="${worklogFilterWeek}" 
+				<vc:select name="worklogFilterWeek" valueObjects="${weeks}" selected="${fn:escapeXml(worklogFilterWeek)}" 
 				valueProperty="code" labelProperty="label" orderBy="code" tabindex="1" />
 			</td>
 			<th><fmt:message key="worklog.project" /></th>
 			<td>
-				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
+				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
 				valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"
 				tabindex="4">
 					<vc:select-option value="">--- <fmt:message key="worklog.allProjects" /> ---</vc:select-option>
 				</vc:select>
 			</td>
@@ -37,11 +37,11 @@
 		<tr>
 			<th>&nbsp;</th>
 			<td>&nbsp;</td>
 			<th><fmt:message key="worklog.activity" /></th>
 			<td>
-				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
+				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 					<vc:select-option value="">--- <fmt:message key="worklog.allActivities" /> ---</vc:select-option>
 				</vc:select> <!-- tabindex="5" -->
 			</td>
 		</tr>
@@ -67,24 +67,24 @@
 	<!-- data columns -->
 	<display:column property="workFrom" titleKey="worklog.date" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
 
 	<display:column titleKey="worklog.project" media="html" >
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.project.code}</span>
-		<span title="${worklog.project.name}">${worklog.project.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
+		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
 	</display:column>
-	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
+	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column titleKey="worklog.activity" media="html">
 		<!-- this is hack for sorting -->
-		<span class="invisible">${worklog.activity.code}</span>
-		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
+		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
+		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
 	</display:column>
-	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
+	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
-	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
+	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
 
 	<display:column property="workFrom" titleKey="worklog.workFrom" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="workTo" titleKey="worklog.workTo" decorator="cz.softinel.retra.core.utils.decorator.HourDecorator"/>
 	<display:column property="hours" titleKey="worklog.hours" sortable="true" format="{0,number,#,##0.00}"/>
 
diff --git a/src/main/webapp/WEB-INF/jsp/system/ChangeVisualConfiguration.jsp b/src/main/webapp/WEB-INF/jsp/system/ChangeVisualConfiguration.jsp
index 5a83199..ded713b 100644
--- a/src/main/webapp/WEB-INF/jsp/system/ChangeVisualConfiguration.jsp
+++ b/src/main/webapp/WEB-INF/jsp/system/ChangeVisualConfiguration.jsp
@@ -9,11 +9,11 @@
 	<table class="formTable">
 		<tr>
 			<spring:bind path="visualConfigurationForm.skinName">
 				<th>Skin</th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${skins}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${skins}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="name" labelProperty="title" >
 						<vc:select-option value="">--- default ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -23,11 +23,11 @@
 		</tr>
 		<tr>
 			<spring:bind path="visualConfigurationForm.timeSelectorImplementation">
 				<th>Time Selector</th>
 				<td>
-					<vc:select name="${status.expression}" valueObjects="${timeSelectors}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${timeSelectors}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="name" labelProperty="title" >
 						<vc:select-option value="">--- default ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -37,11 +37,11 @@
 		</tr>
 		<tr>
 				<th>Default activity for projects</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.da">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -51,20 +51,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p0">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a0">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -74,20 +74,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p1">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a1">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -97,20 +97,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p2">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a2">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -120,20 +120,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p3">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a3">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -143,20 +143,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p4">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a4">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -166,20 +166,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p5">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a5">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -189,20 +189,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p6">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a6">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -212,20 +212,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p7">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a7">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -235,20 +235,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p8">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a8">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
@@ -258,20 +258,20 @@
 		</tr>
 		<tr>
 				<th>Project / Default activity</th>
 				<td>
 			<spring:bind path="visualConfigurationForm.p9">
-					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
 						valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk"> 
 						<vc:select-option value="">--- project ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
 					</c:forEach>
 			</spring:bind>
 			<spring:bind path="visualConfigurationForm.a9">
-					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
+					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
 					valueProperty="pk" labelProperty="codeAndName" orderBy="codeAndName" parentProperty="parent.pk">
 						<vc:select-option value="">--- default activity ---</vc:select-option>
 					</vc:select>					
 					<c:forEach items="${status.errorMessages}">
 						<span class="error"><fmt:message key="error.sign" /></span>
diff --git a/src/main/webapp/WEB-INF/jsp/system/Login.jsp b/src/main/webapp/WEB-INF/jsp/system/Login.jsp
index c06e07e..fb4a76f 100644
--- a/src/main/webapp/WEB-INF/jsp/system/Login.jsp
+++ b/src/main/webapp/WEB-INF/jsp/system/Login.jsp
@@ -5,11 +5,11 @@
 <div class="component dashboardComponentHalf">
 	<h2>Login</h2>
 	<form action="LoginAction.do?fkprm=true&originalUrl=${originalUrl}" method="post">
 		<p>Username</p>
 		<p>
-			<input type="text" name="loginName" value="${loginName}" />
+			<input type="text" name="loginName" value="${fn:escapeXml(loginName)}" />
 		</p>
 		<p>Password</p>
 		<p>
 			<input type="password" name="password" value="" />
 		</p>
diff --git a/src/main/webapp/WEB-INF/jsp/system/RetraError.jsp b/src/main/webapp/WEB-INF/jsp/system/RetraError.jsp
index edff9a9..3b327d6 100644
--- a/src/main/webapp/WEB-INF/jsp/system/RetraError.jsp
+++ b/src/main/webapp/WEB-INF/jsp/system/RetraError.jsp
@@ -3,11 +3,11 @@
 <%@ include file="../Includes.jsp"%> 
 
 <div class="component dashboardComponentHalf">
 	<h2><fmt:message key="retra.error"/></h2>
 	<form action="Newsboard.do?fkprm=true" method="post">
-		<p><fmt:message key="retra.error.id"/>: ${errId}</p>
+		<p><fmt:message key="retra.error.id"/>: ${fn:escapeXml(errId)}</p>
 		<p>
 			<input type="submit" name="submit" class="button" value="<fmt:message key="newsboard.label"/>" />
 		</p>
 	</form>
 </div>
\ No newline at end of file
diff --git a/src/main/webapp/WEB-INF/lovs/years.xml b/src/main/webapp/WEB-INF/lovs/years.xml
index d3faa1d..deb3a98 100644
--- a/src/main/webapp/WEB-INF/lovs/years.xml
+++ b/src/main/webapp/WEB-INF/lovs/years.xml
@@ -22,7 +22,28 @@
 		<field value="2016" key="year.2016" />
 		<field value="2017" key="year.2017" />
 		<field value="2018" key="year.2018" />
 		<field value="2019" key="year.2019" />
 		<field value="2020" key="year.2020" />
+		<field value="2021" key="year.2021" />
+		<field value="2022" key="year.2022" />
+		<field value="2023" key="year.2023" />
+		<field value="2024" key="year.2024" />
+		<field value="2025" key="year.2025" />
+		<field value="2026" key="year.2026" />
+		<field value="2027" key="year.2027" />
+		<field value="2028" key="year.2028" />
+		<field value="2029" key="year.2029" />
+		<field value="2030" key="year.2030" />
+		<field value="2030" key="year.2030" />
+		<field value="2031" key="year.2031" />
+		<field value="2032" key="year.2032" />
+		<field value="2033" key="year.2033" />
+		<field value="2034" key="year.2034" />
+		<field value="2035" key="year.2035" />
+		<field value="2036" key="year.2036" />
+		<field value="2037" key="year.2037" />
+		<field value="2038" key="year.2038" />
+		<field value="2039" key="year.2039" />
+		<field value="2040" key="year.2040" />
 	</lov>
 </lovs>
diff --git a/src/main/webapp/WEB-INF/news/system-news.xml b/src/main/webapp/WEB-INF/news/system-news.xml
index eee6f2c..012a4af 100644
--- a/src/main/webapp/WEB-INF/news/system-news.xml
+++ b/src/main/webapp/WEB-INF/news/system-news.xml
@@ -1,8 +1,19 @@
 <!-- TODO: must be done better structure, keys to message properties etc.  -->
 
 <news>
+	<item date="xx.yy.2022"
+		  title="Build 2.11.0"
+		  body="Fix of these issues:&lt;br />
+		  &lt;a href='https://jira/browse/RETRA-55' target='_blank'>RETRA-55&lt;/a> - Retra logovani - zlepsit, prechod na log4j2.&lt;br />
+		  &lt;a href='https://jira/browse/RETRA-56' target='_blank'>RETRA-56&lt;/a> - Retra je nachylna na XSS.&lt;br />
+		  &lt;a href='https://jira/browse/RETRA-41' target='_blank'>RETRA-41&lt;/a> - Specialni znaky v nazvu projektu.&lt;br />
+		  &lt;a href='https://jira/browse/RETRA-48' target='_blank'>RETRA-48&lt;/a> - Chyba při renderování textu worklogu.&lt;br />
+		  "
+		  author="Retra Team"
+	/>
+
 	<item date="27.6.2019"
 		  title="Build 2.10.0"
 		  body="Fix &lt;a href='https://jira/browse/RETRA-44' target='_blank'>RETRA-44&lt;/a> - Rozsireni exportu Timesheetu a Invoice o sloupec username."
 		  author="Retra Team"
 	/>
@@ -24,11 +35,11 @@
 	<item date="12.3.2019"
 		  title="Build 2.7.0"
 		  body="Bugfixing of jokes generator."
 		  author="Retra Team"
 	/>
-
+<!--
 	<item date="22.5.2018"
 		  title="Build 2.6.0"
 		  body="Small refactoring of permissions and bugfix."
 		  author="Retra Team"
 	/>
@@ -78,11 +89,11 @@
 	<item date="7.2.2016"
 		  title="Build 2.1.0, 2.1.1"
 		  body="New integration with JIRA implemented (worklogs) and some bugfix."
 		  author="Retra Team"
 	/>
-	<!-- item date="2.2.2015"
+	<item date="2.2.2015"
 		  title="Build 2.0.0"
 		  body="Invoice batch generating, filtering projects and employees for assign and some bugfix."
 		  author="Retra Team"
 	/>
 	<item date="8.12.2013"
diff --git a/src/main/webapp/WEB-INF/resources/about.properties b/src/main/webapp/WEB-INF/resources/about.properties
index dc38fb0..7ca0862 100644
--- a/src/main/webapp/WEB-INF/resources/about.properties
+++ b/src/main/webapp/WEB-INF/resources/about.properties
@@ -4,14 +4,14 @@ about.version.label=Version
 about.releasedOn.label=Released on
 about.authors.label=Authors
 about.contributors.label=Contributors
 
 about.version.major=2
-about.version.minor=10
+about.version.minor=11
 about.version.build=0
 
 about.text=Retra is application for managing internal resources and simple internal information system
 
-about.releasedOn=27.6.2019
+about.releasedOn=xx.yy.2022
 
 about.authors=Radek Pinc, Petr S\u00edgl
 about.contributors=Bori\u0161a \u017divkovi\u0107, Pavel M\u00fcller, Jaroslava Faustov\u00e1, Jan N\u011bmec, Karel Mr\u00e1zek, David Smekal, Erik Szalai, Pavel Vlasat\u00fd, Martin Javorek, Milan \u010ce\u010drdle
\ No newline at end of file
diff --git a/src/main/webapp/WEB-INF/resources/messages.properties b/src/main/webapp/WEB-INF/resources/messages.properties
index cbefce8..6b0f470 100644
--- a/src/main/webapp/WEB-INF/resources/messages.properties
+++ b/src/main/webapp/WEB-INF/resources/messages.properties
@@ -1,12 +1,12 @@
 #layout
 header.title=Retra
 header.author=Radek Pinc, Petr S\u00edgl
 header.description=Retra - Resource and Activity Tracker
 header.keywords=Retra, Resource, Activity, Project, Managing, Tracker
-footer.copyright=Copyright &copy; 2007-2019, <a href='About.do?fkprm=true'>Retra Team</a>
-footer.copyright.noLink=Copyright &copy; 2007-2019, Retra Team
+footer.copyright=Copyright &copy; 2007-2022, <a href='About.do?fkprm=true'>Retra Team</a>
+footer.copyright.noLink=Copyright &copy; 2007-2022, Retra Team
 newsboard.label=Newsboard
 dashboard.label=Dashboard
 login.label=Login
 logout.label=Logout
 currentUser.label=Current user

Vulnerable code: 		for (Project p : projects) {
			if (p.getState() == Project.STATE_ACTIVE) {
				filtersList.add(p);
		return "<a href='mailto:" + columnValue + "'>" + columnValue + "</a>";
				typeName = type.getName();
			String comment = schedule.getComment();
						title = code + " - " + issue.getSummary();
					String replacement = String.format(url, code, title, code);
					result = result.replaceAll(code, replacement);
		worklog.setDescriptionGui(JiraHelper.getLinkableText(worklog.getDescription(), jiraLogic));
		if (lov == null || lov.getFields() != null) {
						return v1.compareTo(v2);
				"\n		<option value='" + value + "'" + selectedAttribute + ">" + prefix + label + "</option>");
		<input type="hidden" name="${status.expression}" value="${status.value}" />
				<input type="hidden" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"/>
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"/>
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="hidden" name="${status.expression}" value="${status.value}" />
					<input type="hidden" name="${status.expression}" value="${status.value}" />
					<input type="password" name="${status.expression}" value="${status.value}" />
					<input type="password" name="${status.expression}" value="${status.value}" />
					<input type="password" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="password" name="${status.expression}" value="${status.value}" />
					<input type="password" name="${status.expression}" value="${status.value}" />
					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${status.value}" 
				<input type="hidden" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" />
					<input type="hidden" name="${status.expression}" value="${status.value}" />
					${status.value}
					<input type="text" name="${status.expression}" value="${status.value}" />
					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${status.value}" 
						<c:when test="${status.value != null && status.value == true}"><input type="checkbox" name="${status.expression}" checked="checked" /></c:when>
               <c:forEach items="${status.value}" var="currentProject">
		comparator="${nameComparator}"/>
			<td>${employee.user.contactInfo.displayName}</td>
			<td>${employee.user.contactInfo.firstName}</td>
			<td>${employee.user.contactInfo.lastName}</td>
			<td>${employee.user.contactInfo.email}</td>
			<td>${employee.user.contactInfo.web}</td>
			<td>${employee.user.contactInfo.phone1}</td>
			<td>${employee.user.contactInfo.phone2}</td>
			<td>${employee.user.contactInfo.fax}</td>
			<td>${employee.user.login.name}</td>
			<td>${employee.user.login.ldapLogin}</td>
				<c:if test="${employee.icompany != null}" >${employee.icompany.codeAndName}</c:if>
		<display:column property="name" titleKey="entity.project.name" sortable="true"/>
		<td>${invoiceSeq.codeAndName}</td>
		<td>${form.orderDate}</td>
		<td>${form.finishDate}	</td>
		<td>${form.name}</td>
			<span class="invisible">${employee.icompany.code}</span>
			<span title="${employee.icompany.codeAndName}">${employee.icompany.codeAndName}</span>
		<display:column property="employee.icompany" titleKey="entity.employee.icompany" media="csv excel xml pdf rtf"/>
		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" 	/>
					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceOrderDateId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceFinishDateId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75"/>
		<display:column property="employee.icompany.codeAndName" titleKey="entity.employee.icompany" sortable="true" />		
		<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10"/> 
		<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee"/>
		<display:column property="name" titleKey="entity.invoice.name" sortable="true" />
					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceOrderDateId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceFinishDateId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75"/>
		<input type="hidden" name="${status.expression}" value="${status.value}" />
						<input type="hidden" name="${status.expression}" value="${status.value}" />
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceOrderDateId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="invoiceFinishDateId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75"/>
				<input type="text" name="invoiceFilterOrderDateFrom" value="${invoiceFilterOrderDateFrom}" tabindex="1" id="invoiceFilterOrderDateFromId"/><%--
				<vc:select name="invoiceFilterEmployee" valueObjects="${employees}" selected="${invoiceFilterEmployee}" 
				<input type="text" name="invoiceFilterOrderDateTo" value="${invoiceFilterOrderDateTo}" tabindex="1" id="invoiceFilterOrderDateToId"/><%--
				<input type="text" name="invoiceFilterFinishDateFrom" value="${invoiceFilterFinishDateFrom}" tabindex="1" id="invoiceFilterFinishDateFromId"/><%--
				<input type="text" name="invoiceFilterCode" value="${invoiceFilterCode}" maxlength="30"/>
				<input type="text" name="invoiceFilterFinishDateTo" value="${invoiceFilterFinishDateTo}" tabindex="1" id="invoiceFilterFinishDateToId"/><%--
	<display:column property="orderDate" titleKey="entity.invoice.orderDate" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator" />
	<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10"/> 
	<display:column property="name" titleKey="entity.invoice.name" sortable="true" />
	<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee"/>
	<display:column property="employee.user.login.ldapLogin" titleKey="entity.invoice.employee.ldaplogin" media="csv excel xml pdf rtf" />
			<td>${invoice.code}</td>
			<td>${invoice.employee.user.contactInfo.displayName}</td>
			<td>${invoice.name}</td>
		<display:column titleKey="worklog.project" media="html" >
			<span class="invisible">${worklog.project.code}</span>
			<acronym title="${worklog.project.name}">${worklog.project.code}</acronym>
		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
			<span class="invisible">${worklog.component.code}</span>
			<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf"/>
			<span class="invisible">${worklog.activity.code}</span>
			<acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym>
		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250" size="75" />
					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="15" size="10" />
				<input type="hidden" name="${status.expression}" value="${status.value}" />
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="250"  size="75"/>
					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" maxlength="15" size="10" />
               ${employee.user.contactInfo.displayName}
				<input type="hidden" name="${status.expression}" value="${status.value}" />
			<td>${projectForm.code}</td>
			<td>${projectForm.name}</td>
		<display:column property="code" titleKey="entity.component.code" sortable="true" />
		<display:column property="name" titleKey="entity.component.name" sortable="true" />
				<input type="text" name="projectFilterCode" value="${projectFilterCode}" maxlength="30"/>
				<vc:select name="projectFilterEmployee" valueObjects="${employees}" selected="${projectFilterEmployee}" 
				<input type="text" name="projectFilterName" value="${projectFilterName}" maxlength="255"/>
	<display:column property="parent.code" titleKey="entity.project.parent.code" sortable="true" maxLength="10"/>
	<display:column property="code" titleKey="entity.project.code" sortable="true" maxLength="10"/> 
	<display:column property="name" titleKey="entity.project.name" sortable="true" />
	<display:column property="estimation" titleKey="entity.project.estimation" sortable="true" />
	<display:column property="category.code" titleKey="entity.project.category" sortable="true" />
			<td>${project.parent.code}</td>
			<td>${project.code}</td>
			<td>${project.name}</td>
				<c:if test="${project.category != null}" >${project.category.code} - ${project.category.name}</c:if>
			<td>${project.estimation}</td>
		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true"/>
		<td><input type="hidden" name="${status.expression}" value="${status.value}" /></td>
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleCopyFromId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleCopyDestinationFromId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleCopyDestinationToId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${types}" selected="${status.value}"
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleWorkFromId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleWorkToId"/><%--
					<textarea name="${status.expression}" cols="40" rows="5" >${status.value}</textarea>
		<td><input type="hidden" name="${status.expression}" value="${status.value}" /></td>
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${types}" selected="${status.value}"
					<input type="text" name="${status.expression}" value="${status.value}" id="scheduleWorkToId"/><%--
					<textarea name="${status.expression}" cols="40" rows="5" >${status.value}</textarea>
				<input type="text" name="scheduleFilterFrom" value="${scheduleFilterFrom}" tabindex="1" id="scheduleFilterWorkFromId"/><%--
				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${scheduleFilterEmployee}" 
				<input type="text" name="scheduleFilterTo" value="${scheduleFilterTo}" tabindex="2" id="scheduleFilterWorkToId"/><%--
				<vc:select name="scheduleFilterType" valueObjects="${types}" selected="${scheduleFilterType}"
				<vc:select name="scheduleFilterState" valueObjects="${scheduleStates}" selected="${scheduleFilterState}"
		<span class="invisible">${schedule.type.code}</span>
		<span title="${schedule.type.name}">${schedule.type.code}</span>
	<display:column property="type.code" titleKey="schedule.type" sortable="true" media="csv excel xml pdf rtf"/>
		<fmt:message key="schedule.state.${schedule.state}"/>
				<vc:select name="scheduleFilterMonth" valueObjects="${months}" selected="${scheduleFilterMonth}"
				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${scheduleFilterEmployee}" 
				<vc:select name="scheduleFilterYear" valueObjects="${years}" selected="${scheduleFilterYear}"
	<display:caption>${employee.user.contactInfo.displayName} - <fmt:message key="month.${scheduleFilterMonth}"/> ${scheduleFilterYear}</display:caption>
			<c:forEach items="${types}" var="type"><td class="center ${type.cssClass}">${type.name}</td></c:forEach>
<c:set var="requestURI" value="ScheduleList.do?fkprm=true&scheduleFilterEmployee=${schedule.employee.pk}" />
			<td>${schedule.comment}</td>
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${components}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkFromId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkToId"/><%--
					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${status.value}</textarea>
					<input type="text" name="${status.expression}" value="${status.value}" id="jiraissue" maxlength="50"/>
				<input type="text" name="worklogFilterDate" value="${worklogFilterDate}" tabindex="1" id="worklogFilterDateId"/><%--
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
	<caption>Daily worklog for ${employee.user.contactInfo.displayName}, ${worklogFilterDate} (<fmt:message key="day.${dayOfWeek}"/>&nbsp;-&nbsp;<span class="${dayOfWeekCss}" title="<fmt:message key="${dayOfWeekTitle}"/>">&nbsp;&nbsp;&nbsp;</span>)</caption>
				<td><acronym title="${worklog.project.name}">${worklog.project.code}</acronym></td>
				<td><acronym title="${worklog.component.name}">${worklog.component.code}</acronym></td>
				<td><acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym></td>
				<td class="nowrap"><acronym title="${worklog.invoice.name}">${worklog.invoice.code}</acronym><c:if test="${worklog.invoice != null}">&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/></c:if></td>
							<a href="WorklogDailyCreate.do?fkprm=true&setDate=${worklogFilterDate}">Insert new worklog item</a>
			<th>${project.key.code}</th>
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
				<input type="text" name="worklogFilterDate" value="${worklogFilterDate}" tabindex="1" id="worklogFilterDateId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
		<span class="invisible">${worklog.project.code}</span>
		<span title="${worklog.project.name}">${worklog.project.code}</span>
	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
		<span class="invisible">${worklog.activity.code}</span>
		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
	<display:column property="descriptionGui" titleKey="worklog.description" media="html"/>	
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
		<td><input type="hidden" name="${status.expression}" value="${status.value}" /></td>
					<input type="text" name="${status.expression}" value="${status.value}"  id="worklogDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${components}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkFromId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogWorkToId" /><%--
					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${status.value}</textarea>
					<input type="text" name="${status.expression}" value="${status.value}" id="jiraissue" maxlength="50"/>
		<display:column property="project.code" titleKey="worklog.project" />
		<display:column property="activity.code" titleKey="worklog.activity" />
		<display:column property="invoice.name" titleKey="workLog.invoice"/>
		<display:column property="description" titleKey="worklog.description"/>
				<th>${externalProject.name}</th>
					<vc:select name="externalProjects[${status.index}].projectId" valueObjects="${projects}" selected="${externalProject.projectId}" 
					<vc:select name="externalProjects[${status.index}].invoiceId" valueObjects="${invoices}" selected="${externalProject.invoiceId}" 
				<th>${externalActivity.name}</th>
					<vc:select name="externalActivities[${status.index}].activityId" valueObjects="${activities}" selected="${externalActivity.activityId}" 
		<td>${invoice.code}</td>
		<td>${invoice.employee.user.contactInfo.displayName}</td>
		<td>${invoice.name}</td>
			<span class="invisible">${worklog.project.code}</span>
			<span title="${worklog.project.name}">${worklog.project.code}</span>
		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
			<span class="invisible">${worklog.component.code}</span>
			<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf"/>
			<span class="invisible">${worklog.activity.code}</span>
			<span title="${worklog.activity.name}">${worklog.activity.code}</span>
		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${status.value}" 
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogDateFromId"/><%--
					<input type="text" name="${status.expression}" value="${status.value}" id="worklogDateToId"/><%--
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
				<input type="text" name="worklogFilterFrom" value="${worklogFilterFrom}" tabindex="1" id="worklogFilterWorkFromId"/><%--
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
				<input type="text" name="worklogFilterTo" value="${worklogFilterTo}" tabindex="2" id="worklogFilterWorkToId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
	<display:caption>${employee.user.contactInfo.displayName}</display:caption>
		<span class="invisible">${worklog.project.code}</span>
		<span title="${worklog.project.name}">${worklog.project.code}</span>
	<display:column property="project.code" titleKey="worklog.project" sortable="true" media="csv excel xml pdf rtf"/>
		<span class="invisible">${worklog.activity.code}</span>
		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
	<display:column property="activity.code" titleKey="worklog.activity" sortable="true" media="csv excel xml pdf rtf"/>
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${worklogFilterMonth}"
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${worklogFilterYear}"
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
		<span class="invisible">${worklog.project.code}</span>
		<span title="${worklog.project.name}">${worklog.project.code}</span>
	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
		<span class="invisible">${worklog.activity.code}</span>
		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
				<input type="text" name="worklogFilterFrom" value="${worklogFilterFrom}" tabindex="1" id="worklogFilterWorkFromId"/><%--
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
				<input type="text" name="worklogFilterTo" value="${worklogFilterTo}" tabindex="2" id="worklogFilterWorkToId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
				<input type="text" name="worklogFilterInvoiceCode" value="${worklogFilterInvoiceCode}" maxlength="30"/>
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
								<option value="${relation.code}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
								<option value="${relation.code}"><fmt:message key="invoice.relation.${relation.code}" /></option>
		<h2 class="visibleOnlyInPrint">${employee.user.contactInfo.displayName}: ${worklogFilterFrom} - ${worklogFilterTo}</h2>
					<span class="invisible">${worklog.project.code}</span>
					<acronym title="${worklog.project.name}">${worklog.project.code}</acronym>
				<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
					<span class="invisible">${worklog.component.code}</span>
					<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
				<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf"/>			
					<span class="invisible">${worklog.activity.code}</span>
					<acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym>
						<span class="invisible">${worklog.invoice.code}</span>
						<acronym title="${worklog.invoice.name}">${worklog.invoice.code}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/>
				<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf"/>
				<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee"/>
				<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
					<th>${project.key}</th>
					<td>${project.key}</td>
					<td>${activity.key}</td>
					<th>Week ${week.key}</th>
					<th>${activity.key}</th>
					<th>${project.key}</th>
				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${worklogFilterMonth}"
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${worklogFilterYear}"
	<display:caption>${employee.user.contactInfo.displayName} - <fmt:message key="month.${worklogFilterMonth}"/> ${worklogFilterYear}</display:caption>
		${worklog.project.code} - ${worklog.project.name}
		${worklog.activity.code} - ${worklog.activity.name}
				<input type="text" name="worklogFilterFrom" value="${worklogFilterFrom}" tabindex="1" id="worklogFilterWorkFromId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
				<input type="text" name="worklogFilterTo" value="${worklogFilterTo}" tabindex="2" id="worklogFilterWorkToId"/><%--
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
				<input type="text" name="worklogFilterInvoiceCode" value="${worklogFilterInvoiceCode}" maxlength="30"/>
								<option value="${relation.code}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
								<option value="${relation.code}"><fmt:message key="invoice.relation.${relation.code}" /></option>
			<display:column property="key" titleKey="worklog.employee" />
			<display:column property="keyInfo" titleKey="worklog.employee.ldaplogin" media="csv excel xml pdf rtf"/>			
			<display:column property="key" titleKey="worklog.activity" />
			<display:column property="key" titleKey="worklog.project" />
					<th>${activity.key}</th>
					<th>${employee.key}</th>
					<th>${project.key}</th>
					<th>${employee.key}</th>
					<th>${activity.key}</th>
					<th>${project.key}</th>
				<span class="invisible">${worklog.project.code}</span>
				<acronym title="${worklog.project.name}">${worklog.project.code}</acronym>
			<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
				<span class="invisible">${worklog.component.code}</span>
				<acronym title="${worklog.component.name}">${worklog.component.code}</acronym>
			<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf"/>
				<span class="invisible">${worklog.activity.code}</span>
				<acronym title="${worklog.activity.name}">${worklog.activity.code}</acronym>
			<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
					<span class="invisible">${worklog.invoice.code}</span>
					<acronym title="${worklog.invoice.name}">${worklog.invoice.code}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="middle"/>
			<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf"/>
			<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee"/>
			<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
			<td>${worklog.project.code} - ${worklog.project.name}</td>
				<c:if test="${worklog.component != null}" >${worklog.component.code} - ${worklog.component.name}</c:if>
			<td>${worklog.activity.code} - ${worklog.activity.name}</td>
				<c:if test="${worklog.onInvoice}" >${worklog.invoice.code} (${worklog.invoice.name})&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle" /></c:if>
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${worklogFilterEmployee}" 
				<vc:select name="worklogFilterWeek" valueObjects="${weeks}" selected="${worklogFilterWeek}" 
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${worklogFilterProject}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${worklogFilterActivity}" 
		<span class="invisible">${worklog.project.code}</span>
		<span title="${worklog.project.name}">${worklog.project.code}</span>
	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf"/>
		<span class="invisible">${worklog.activity.code}</span>
		<span title="${worklog.activity.name}">${worklog.activity.code}</span>
	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf"/>
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf"/>
					<vc:select name="${status.expression}" valueObjects="${skins}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${timeSelectors}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${status.value}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${status.value}" 
			<input type="text" name="loginName" value="${loginName}" />
		<p><fmt:message key="retra.error.id"/>: ${errId}</p>

	<!-- item date="2.2.2015"
about.version.minor=10
about.releasedOn=27.6.2019
footer.copyright=Copyright &copy; 2007-2019, <a href='About.do?fkprm=true'>Retra Team</a>
footer.copyright.noLink=Copyright &copy; 2007-2019, Retra Team
Fixed code: 		if (projects != null && !projects.isEmpty()) {
			for (Project p : projects) {
				if (p.getState() == Project.STATE_ACTIVE) {
					filtersList.add(p);
				}
import org.apache.commons.lang.StringEscapeUtils;
		if (columnValue instanceof String) {
			return StringEscapeUtils.escapeHtml(columnValue.toString());
		}
		
import org.apache.commons.lang.StringEscapeUtils;
		String escaped = StringEscapeUtils.escapeHtml(columnValue.toString());
		return "<a href='mailto:" + escaped + "'>" + escaped + "</a>";
import org.apache.commons.lang.StringEscapeUtils;
		if (columnValue instanceof String) {
			return StringEscapeUtils.escapeHtml(columnValue.toString());
		}

import org.apache.commons.lang.StringEscapeUtils;
		if (columnValue instanceof String) {
			return StringEscapeUtils.escapeHtml(columnValue.toString());
		}

import org.apache.commons.lang.StringEscapeUtils;
				typeName = StringEscapeUtils.escapeHtml(type.getName());
			String comment = StringEscapeUtils.escapeHtml(schedule.getComment());
		if (columnValue instanceof String) {
			result = StringEscapeUtils.escapeHtml(columnValue.toString());
		}

import org.apache.commons.lang.StringEscapeUtils;

						String summary = getSafeJiraText(issue.getSummary());
						title = code + " - " + summary;
						String replacement = String.format(url, code, title, code);
						result = result.replaceAll(code, replacement);
	public static String getSafeJiraText(final String text) {
		String safeText = "";
		if (text != null) {
			safeText = StringEscapeUtils.escapeHtml(text);
			safeText = safeText.replace("$", "&dollar;").replace("{", "&lcub;").replace("}", "&rcub;");
		}
		return safeText;
	}
	public void setSummary(String summary) {
		if (fields != null) {
			this.fields.setSummary(summary); 
		}
	}

import org.apache.commons.lang.StringEscapeUtils;
		worklog.setDescriptionGui(JiraHelper.getLinkableText(StringEscapeUtils.escapeHtml(worklog.getDescription()), jiraLogic));
				ji.setSummary(JiraHelper.getSafeJiraText(ji.getSummary()));
		if (lov == null || lov.getFields() == null) {
import org.apache.commons.lang.StringEscapeUtils;
import org.apache.poi.util.StringUtil;
						if (v1 != null && v2 != null) {
							return v1.compareTo(v2);							
						} else {
							if (v2 == null) {
								return 0;
							} else {
								return -1;
							}
						}
		String escapedValue = StringEscapeUtils.escapeHtml(value);
		String escapedLabel = StringEscapeUtils.escapeHtml(label);
		
				"\n		<option value='" + escapedValue + "'" + selectedAttribute + ">" + prefix + escapedLabel + "</option>");
--%><%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %><%--
		<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="password" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${fn:escapeXml(status.value)}" 
				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<input type="hidden" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					${fn:escapeXml(fn:escapeXml(status.value))}
					<input type="text" name="${status.expression}" value="${fn:escapeXml(fn:escapeXml(status.value))}" />
					<vc:select name="${status.expression}" valueObjects="${icompanies}" selected="${fn:escapeXml(fn:escapeXml(status.value))}" 
						<c:when test="${fn:escapeXml(status.value) != null && fn:escapeXml(status.value) == true}"><input type="checkbox" name="${status.expression}" checked="checked" /></c:when>
               <c:forEach items="${fn:escapeXml(status.value)}" var="currentProject">
		comparator="${nameComparator}" escapeXml="true" />
			<td>${fn:escapeXml(employee.user.contactInfo.displayName)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.firstName)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.lastName)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.email)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.web)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.phone1)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.phone2)}</td>
			<td>${fn:escapeXml(employee.user.contactInfo.fax)}</td>
			<td>${fn:escapeXml(employee.user.login.name)}</td>
			<td>${fn:escapeXml(employee.user.login.ldapLogin)}</td>
				<c:if test="${employee.icompany != null}" >${fn:escapeXml(employee.icompany.codeAndName)}</c:if>
		<display:column property="name" titleKey="entity.project.name" sortable="true" escapeXml="true"/>
		<td>${fn:escapeXml(invoiceSeq.codeAndName)}</td>
		<td>${fn:escapeXml(form.orderDate)}</td>
		<td>${fn:escapeXml(form.finishDate)}	</td>
		<td>${fn:escapeXml(form.name)}</td>
			<span class="invisible">${fn:escapeXml(employee.icompany.code)}</span>
			<span title="${fn:escapeXml(employee.icompany.codeAndName)}">${fn:escapeXml(employee.icompany.codeAndName)}</span>
		<display:column property="employee.icompany" titleKey="entity.employee.icompany" media="csv excel xml pdf rtf" escapeXml="true"/>
		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" escapeXml="true"/>
					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceOrderDateId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceFinishDateId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75"/>
		<display:column property="employee.icompany.codeAndName" titleKey="entity.employee.icompany" sortable="true" escapeXml="true" />		
		<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10" escapeXml="true" /> 
		<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee" escapeXml="true" />
		<display:column property="name" titleKey="entity.invoice.name" sortable="true" escapeXml="true" />
					<vc:select name="${status.expression}" valueObjects="${sequences}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceOrderDateId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceFinishDateId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75"/>
		<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
						<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceOrderDateId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="invoiceFinishDateId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75"/>
				<input type="text" name="invoiceFilterOrderDateFrom" value="${fn:escapeXml(invoiceFilterOrderDateFrom)}" tabindex="1" id="invoiceFilterOrderDateFromId"/><%--
				<vc:select name="invoiceFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(invoiceFilterEmployee)}" 
				<input type="text" name="invoiceFilterOrderDateTo" value="${fn:escapeXml(invoiceFilterOrderDateTo)}" tabindex="1" id="invoiceFilterOrderDateToId"/><%--
				<input type="text" name="invoiceFilterFinishDateFrom" value="${fn:escapeXml(invoiceFilterFinishDateFrom)}" tabindex="1" id="invoiceFilterFinishDateFromId"/><%--
				<input type="text" name="invoiceFilterCode" value="${fn:escapeXml(invoiceFilterCode)}" maxlength="30"/>
				<input type="text" name="invoiceFilterFinishDateTo" value="${fn:escapeXml(invoiceFilterFinishDateTo)}" tabindex="1" id="invoiceFilterFinishDateToId"/><%--
	<display:column property="orderDate" titleKey="entity.invoice.orderDate" sortable="true" decorator="cz.softinel.retra.core.utils.decorator.DateDecorator"/>
	<display:column property="code" titleKey="entity.invoice.code" sortable="true" maxLength="10" escapeXml="true" /> 
	<display:column property="name" titleKey="entity.invoice.name" sortable="true" escapeXml="true" />
	<display:column property="employee.user.contactInfo.displayName" titleKey="entity.invoice.employee" escapeXml="true" />
	<display:column property="employee.user.login.ldapLogin" titleKey="entity.invoice.employee.ldaplogin" media="csv excel xml pdf rtf" escapeXml="true"/>
			<td>${fn:escapeXml(invoice.code)}</td>
			<td>${fn:escapeXml(invoice.employee.user.contactInfo.displayName)}</td>
			<td>${fn:escapeXml(invoice.name)}</td>
		<display:column titleKey="worklog.project" media="html">
			<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
			<acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym>
		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true"/>
			<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
			<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf" escapeXml="true"/>
			<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
			<acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym>
		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true"/>
		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true"/>
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250" size="75" />
					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="15" size="10" />
				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="30"/>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="250"  size="75"/>
					<vc:select name="${status.expression}" valueObjects="${categories}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" maxlength="15" size="10" />
               ${fn:escapeXml(employee.user.contactInfo.displayName)}
				<input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" />
			<td>${fn:escapeXml(projectForm.code)}</td>
			<td>${fn:escapeXml(projectForm.name)}</td>
		<display:column property="code" titleKey="entity.component.code" sortable="true" escapeXml="true" />
		<display:column property="name" titleKey="entity.component.name" sortable="true" escapeXml="true" />
				<input type="text" name="projectFilterCode" value="${fn:escapeXml(projectFilterCode)}" maxlength="30"/>
				<vc:select name="projectFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(projectFilterEmployee)}" 
				<input type="text" name="projectFilterName" value="${fn:escapeXml(projectFilterName)}" maxlength="255"/>
	<display:column property="parent.code" titleKey="entity.project.parent.code" sortable="true" maxLength="10" escapeXml="true" />
	<display:column property="code" titleKey="entity.project.code" sortable="true" maxLength="10" escapeXml="true" /> 
	<display:column property="name" titleKey="entity.project.name" sortable="true"  escapeXml="true"/>
	<display:column property="estimation" titleKey="entity.project.estimation" sortable="true" escapeXml="true" />
	<display:column property="category.code" titleKey="entity.project.category" sortable="true" escapeXml="true" />
			<td>${fn:escapeXml(project.parent.code)}</td>
			<td>${fn:escapeXml(project.code)}</td>
			<td>${fn:escapeXml(project.name)}</td>
				<c:if test="${project.category != null}" >${fn:escapeXml(project.category.code)} - ${fn:escapeXml(project.category.name)}</c:if>
			<td>${fn:escapeXml(project.estimation)}</td>
		<display:column property="user.contactInfo.displayName" titleKey="entity.contactInfo.displayName" sortable="true" escapeXml="true" />
		<td><input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" /></td>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleCopyFromId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleCopyDestinationFromId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleCopyDestinationToId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${types}" selected="${fn:escapeXml(status.value)}"
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleWorkFromId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleWorkToId"/><%--
					<textarea name="${status.expression}" cols="40" rows="5" >${fn:escapeXml(status.value)}</textarea>
		<td><input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" /></td>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${types}" selected="${fn:escapeXml(status.value)}"
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="scheduleWorkToId"/><%--
					<textarea name="${status.expression}" cols="40" rows="5" >${fn:escapeXml(status.value)}</textarea>
				<input type="text" name="scheduleFilterFrom" value="${fn:escapeXml(scheduleFilterFrom)}" tabindex="1" id="scheduleFilterWorkFromId"/><%--
				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(scheduleFilterEmployee)}" 
				<input type="text" name="scheduleFilterTo" value="${fn:escapeXml(scheduleFilterTo)}" tabindex="2" id="scheduleFilterWorkToId"/><%--
				<vc:select name="scheduleFilterType" valueObjects="${types}" selected="${fn:escapeXml(scheduleFilterType)}"
				<vc:select name="scheduleFilterState" valueObjects="${scheduleStates}" selected="${fn:escapeXml(scheduleFilterState)}"
		<span class="invisible">${fn:escapeXml(schedule.type.code)}</span>
		<span title="${fn:escapeXml(schedule.type.name)}">${fn:escapeXml(schedule.type.code)}</span>
	<display:column property="type.code" titleKey="schedule.type" sortable="true" media="csv excel xml pdf rtf" escapeXml="true" />
		<fmt:message key="schedule.state.${fn:escapeXml(schedule.state)}"/>
				<vc:select name="scheduleFilterMonth" valueObjects="${months}" selected="${fn:escapeXml(scheduleFilterMonth)}"
				<vc:select name="scheduleFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(scheduleFilterEmployee)}" 
				<vc:select name="scheduleFilterYear" valueObjects="${years}" selected="${fn:escapeXml(scheduleFilterYear)}"
	<display:caption>${fn:escapeXml(employee.user.contactInfo.displayName)} - <fmt:message key="month.${fn:escapeXml(scheduleFilterMonth)}"/> ${fn:escapeXml(scheduleFilterYear)}</display:caption>
			<c:forEach items="${types}" var="type"><td class="center ${type.cssClass}">${fn:escapeXml(type.name)}</td></c:forEach>
<c:set var="requestURI" value="ScheduleList.do?fkprm=true&scheduleFilterEmployee=${fn:escapeXml(schedule.employee.pk)}" />
			<td>${fn:escapeXml(schedule.comment)}</td>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${components}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkFromId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkToId"/><%--
					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${fn:escapeXml(status.value)}</textarea>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="jiraissue" maxlength="50"/>
				<input type="text" name="worklogFilterDate" value="${fn:escapeXml(worklogFilterDate)}" tabindex="1" id="worklogFilterDateId"/><%--
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
	<caption>Daily worklog for ${fn:escapeXml(employee.user.contactInfo.displayName)}, ${fn:escapeXml(worklogFilterDate)} (<fmt:message key="day.${dayOfWeek}"/>&nbsp;-&nbsp;<span class="${dayOfWeekCss}" title="<fmt:message key="${dayOfWeekTitle}"/>">&nbsp;&nbsp;&nbsp;</span>)</caption>
				<td><acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym></td>
				<td><acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym></td>
				<td><acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym></td>
				<td class="nowrap"><acronym title="${fn:escapeXml(worklog.invoice.name)}">${fn:escapeXml(worklog.invoice.code)}</acronym><c:if test="${worklog.invoice != null}">&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/></c:if></td>
							<a href="WorklogDailyCreate.do?fkprm=true&setDate=${fn:escapeXml(worklogFilterDate)}">Insert new worklog item</a>
			<th>${fn:escapeXml(project.key.code)}</th>
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
				<input type="text" name="worklogFilterDate" value="${fn:escapeXml(worklogFilterDate)}" tabindex="1" id="worklogFilterDateId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
	<display:column property="descriptionGui" titleKey="worklog.description" media="html" escapeXml="true" />	
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true "/>
		<td><input type="hidden" name="${status.expression}" value="${fn:escapeXml(status.value)}" /></td>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}"  id="worklogDateId"/><%--
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${components}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkFromId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogWorkToId" /><%--
					<textarea id="descriptionId" name="${status.expression}" cols="40" rows="7" onkeypress="return imposeMaxLength(event, this, 249);">${fn:escapeXml(status.value)}</textarea>
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="jiraissue" maxlength="50"/>
		<display:column property="project.code" titleKey="worklog.project" escapeXml="true" />
		<display:column property="activity.code" titleKey="worklog.activity" escapeXml="true" />
		<display:column property="invoice.name" titleKey="workLog.invoice" escapeXml="true" />
		<display:column property="description" titleKey="worklog.description" escapeXml="true" />
				<th>${fn:escapeXml(externalProject.name)}</th>
					<vc:select name="externalProjects[${status.index}].projectId" valueObjects="${projects}" selected="${fn:escapeXml(externalProject.projectId)}" 
					<vc:select name="externalProjects[${status.index}].invoiceId" valueObjects="${invoices}" selected="${fn:escapeXml(externalProject.invoiceId)}" 
				<th>${fn:escapeXml(externalActivity.name)}</th>
					<vc:select name="externalActivities[${status.index}].activityId" valueObjects="${activities}" selected="${fn:escapeXml(externalActivity.activityId)}"
		<td>${fn:escapeXml(invoice.code)}</td>
		<td>${fn:escapeXml(invoice.employee.user.contactInfo.displayName)}</td>
		<td>${fn:escapeXml(invoice.name)}</td>
			<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
			<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
		<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
			<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
			<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
		<display:column property="component.code" titleKey="worklog.component" media="csv excel xml pdf rtf" escapeXml="true" />
			<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
			<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
		<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
		<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${invoices}" selected="${fn:escapeXml(status.value)}" 
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogDateFromId"/><%--
					<input type="text" name="${status.expression}" value="${fn:escapeXml(status.value)}" id="worklogDateToId"/><%--
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
				<input type="text" name="worklogFilterFrom" value="${fn:escapeXml(worklogFilterFrom)}" tabindex="1" id="worklogFilterWorkFromId"/><%--
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
				<input type="text" name="worklogFilterTo" value="${fn:escapeXml(worklogFilterTo)}" tabindex="2" id="worklogFilterWorkToId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
	<display:caption>${fn:escapeXml(employee.user.contactInfo.displayName)}</display:caption>
		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
	<display:column property="project.code" titleKey="worklog.project" sortable="true" media="csv excel xml pdf rtf" escapeXml="true"/>
		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
	<display:column property="activity.code" titleKey="worklog.activity" sortable="true" media="csv excel xml pdf rtf" escapeXml="true" />
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true"/>
				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${fn:escapeXml(worklogFilterMonth)}"
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${fn:escapeXml(worklogFilterYear)}"
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
				<input type="text" name="worklogFilterFrom" value="${fn:escapeXml(worklogFilterFrom)}" tabindex="1" id="worklogFilterWorkFromId"/><%--
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
				<input type="text" name="worklogFilterTo" value="${fn:escapeXml(worklogFilterTo)}" tabindex="2" id="worklogFilterWorkToId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
				<input type="text" name="worklogFilterInvoiceCode" value="${fn:escapeXml(worklogFilterInvoiceCode)}" maxlength="30"/>
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
								<option value="${fn:escapeXml(relation.code)}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
								<option value="${fn:escapeXml(relation.code)}"><fmt:message key="invoice.relation.${relation.code}" /></option>
		<h2 class="visibleOnlyInPrint">${fn:escapeXml(employee.user.contactInfo.displayName)}: ${fn:escapeXml(worklogFilterFrom)} - ${fn:escapeXml(worklogFilterTo)}</h2>
					<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
					<acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym>
				<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
					<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
					<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
				<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf" escapeXml="true" />			
					<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
					<acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym>
						<span class="invisible">${fn:escapeXml(worklog.invoice.code)}</span>
						<acronym title="${fn:escapeXml(worklog.invoice.name)}">${fn:escapeXml(worklog.invoice.code)}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle"/>
				<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf" escapeXml="true" />
				<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee" escapeXml="true" />
				<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
					<th>${fn:escapeXml(project.key)}</th>
					<td>${fn:escapeXml(project.key)}</td>
					<td>${fn:escapeXml(activity.key)}</td>
					<th>Week ${fn:escapeXml(week.key)}</th>
					<th>${fn:escapeXml(activity.key)}</th>
					<th>${fn:escapeXml(project.key)}</th>
				<vc:select name="worklogFilterMonth" valueObjects="${months}" selected="${fn:escapeXml(worklogFilterMonth)}"
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
				<vc:select name="worklogFilterYear" valueObjects="${years}" selected="${fn:escapeXml(worklogFilterYear)}"
	<display:caption>${fn:escapeXml(employee.user.contactInfo.displayName)} - <fmt:message key="month.${worklogFilterMonth}"/> ${fn:escapeXml(worklogFilterYear)}</display:caption>
		${fn:escapeXml(worklog.project.codefn:escapeXml)} - ${fn:escapeXml(worklog.project.name)}
		${fn:escapeXml(worklog.activity.code)} - ${fn:escapeXml(worklog.activity.name)}
				<input type="text" name="worklogFilterFrom" value="${fn:escapeXml(worklogFilterFrom)}" tabindex="1" id="worklogFilterWorkFromId"/><%--
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
				<input type="text" name="worklogFilterTo" value="${fn:escapeXml(worklogFilterTo)}" tabindex="2" id="worklogFilterWorkToId"/><%--
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
				<input type="text" name="worklogFilterInvoiceCode" value="${fn:escapeXml(worklogFilterInvoiceCode)}" maxlength="30"/>
								<option value="${fn:escapeXml(relation.code)}" selected="selected"><fmt:message key="invoice.relation.${relation.code}" /></option>
								<option value="${fn:escapeXml(relation.code)}"><fmt:message key="invoice.relation.${relation.code}" /></option>
			<display:column property="key" titleKey="worklog.employee" escapeXml="true"/>
			<display:column property="keyInfo" titleKey="worklog.employee.ldaplogin" media="csv excel xml pdf rtf" escapeXml="true" />			
			<display:column property="key" titleKey="worklog.activity" escapeXml="true" />
			<display:column property="key" titleKey="worklog.project" escapeXml="true" />
					<th>${fn:escapeXml(activity.key)}</th>
					<th>${fn:escapeXml(employee.key)}</th>
					<th>${fn:escapeXml(project.key)}</th>
					<th>${fn:escapeXml(employee.key)}</th>
					<th>${fn:escapeXml(activity.key)}</th>
					<th>${fn:escapeXml(project.key)}</th>
				<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
				<acronym title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</acronym>
			<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
				<span class="invisible">${fn:escapeXml(worklog.component.code)}</span>
				<acronym title="${fn:escapeXml(worklog.component.name)}">${fn:escapeXml(worklog.component.code)}</acronym>
			<display:column property="component.code" titleKey="worklog.component" media="csv excel xml rtf" escapeXml="true" />
				<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
				<acronym title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</acronym>
			<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
					<span class="invisible">${fn:escapeXml(worklog.invoice.code)}</span>
					<acronym title="${fn:escapeXml(worklog.invoice.name)}">${fn:escapeXml(worklog.invoice.code)}</acronym>&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="middle"/>
			<display:column property="invoice.code" titleKey="worklog.invoice" media="csv excel xml rtf" escapeXml="true" />
			<display:column property="employee.user.contactInfo.displayName" titleKey="worklog.employee" escapeXml="true" />
			<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
			<td>${fn:escapeXml(worklog.project.code)} - ${fn:escapeXml(worklog.project.name)}</td>
				<c:if test="${worklog.component != null}" >${fn:escapeXml(worklog.component.code)} - ${fn:escapeXml(worklog.component.name)}</c:if>
			<td>${fn:escapeXml(worklog.activity.code)} - ${fn:escapeXml(worklog.activity.name)}</td>
				<c:if test="${worklog.onInvoice}" >${fn:escapeXml(worklog.invoice.code)} (${fn:escapeXml(worklog.invoice.name)})&nbsp;-&nbsp;<img src="${imgRoot}/<fmt:message key='invoice.state.img.${worklog.invoice.state}' />" alt="<fmt:message key='invoice.state.${worklog.invoice.state}' />" title="<fmt:message key='invoice.state.${worklog.invoice.state}' />" align="absmiddle" /></c:if>
				<vc:select name="worklogFilterEmployee" valueObjects="${employees}" selected="${fn:escapeXml(worklogFilterEmployee)}" 
				<vc:select name="worklogFilterWeek" valueObjects="${weeks}" selected="${fn:escapeXml(worklogFilterWeek)}" 
				<vc:select name="worklogFilterProject" valueObjects="${projects}" selected="${fn:escapeXml(worklogFilterProject)}" 
				<vc:select name="worklogFilterActivity" valueObjects="${activities}" selected="${fn:escapeXml(worklogFilterActivity)}" 
		<span class="invisible">${fn:escapeXml(worklog.project.code)}</span>
		<span title="${fn:escapeXml(worklog.project.name)}">${fn:escapeXml(worklog.project.code)}</span>
	<display:column property="project.code" titleKey="worklog.project" media="csv excel xml pdf rtf" escapeXml="true" />
		<span class="invisible">${fn:escapeXml(worklog.activity.code)}</span>
		<span title="${fn:escapeXml(worklog.activity.name)}">${fn:escapeXml(worklog.activity.code)}</span>
	<display:column property="activity.code" titleKey="worklog.activity" media="csv excel xml pdf rtf" escapeXml="true" />
	<display:column property="description" titleKey="worklog.description" media="csv excel xml pdf rtf" escapeXml="true" />
					<vc:select name="${status.expression}" valueObjects="${skins}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${timeSelectors}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${projects}" selected="${fn:escapeXml(status.value)}" 
					<vc:select name="${status.expression}" valueObjects="${activities}" selected="${fn:escapeXml(status.value)}" 
			<input type="text" name="loginName" value="${fn:escapeXml(loginName)}" />
		<p><fmt:message key="retra.error.id"/>: ${fn:escapeXml(errId)}</p>
		<field value="2021" key="year.2021" />
		<field value="2022" key="year.2022" />
		<field value="2023" key="year.2023" />
		<field value="2024" key="year.2024" />
		<field value="2025" key="year.2025" />
		<field value="2026" key="year.2026" />
		<field value="2027" key="year.2027" />
		<field value="2028" key="year.2028" />
		<field value="2029" key="year.2029" />
		<field value="2030" key="year.2030" />
		<field value="2030" key="year.2030" />
		<field value="2031" key="year.2031" />
		<field value="2032" key="year.2032" />
		<field value="2033" key="year.2033" />
		<field value="2034" key="year.2034" />
		<field value="2035" key="year.2035" />
		<field value="2036" key="year.2036" />
		<field value="2037" key="year.2037" />
		<field value="2038" key="year.2038" />
		<field value="2039" key="year.2039" />
		<field value="2040" key="year.2040" />
	<item date="xx.yy.2022"
		  title="Build 2.11.0"
		  body="Fix of these issues:&lt;br />
		  &lt;a href='https://jira/browse/RETRA-55' target='_blank'>RETRA-55&lt;/a> - Retra logovani - zlepsit, prechod na log4j2.&lt;br />
		  &lt;a href='https://jira/browse/RETRA-56' target='_blank'>RETRA-56&lt;/a> - Retra je nachylna na XSS.&lt;br />
		  &lt;a href='https://jira/browse/RETRA-41' target='_blank'>RETRA-41&lt;/a> - Specialni znaky v nazvu projektu.&lt;br />
		  &lt;a href='https://jira/browse/RETRA-48' target='_blank'>RETRA-48&lt;/a> - Chyba při renderování textu worklogu.&lt;br />
		  "
		  author="Retra Team"
	/>

<!--
	<item date="2.2.2015"
about.version.minor=11
about.releasedOn=xx.yy.2022
footer.copyright=Copyright &copy; 2007-2022, <a href='About.do?fkprm=true'>Retra Team</a>
footer.copyright.noLink=Copyright &copy; 2007-2022, Retra Team