Issue 1120: Cross-site scripting

When a users forges the following request:

http://url/index.php?action=blocks&height=28754&page=statistics%3csvg%20xmlns%3d%22http://www.w3.org/2000/svg%22%3e%3cmeta%20http-equiv=%22refresh%22%20content=%220%3b%20url=http://example.com/%22%20/%3e%3c/svg%3e&prev=1

It will allow script execution.

To fix this, public/templates/mpos/global/breadcrumbs.tpl has to be changed so it escapes the name of the page. I'll try to create a pull request for this.