Security fixes for assigned templates
JS-santization of filter options before displaying them FIX 2.2
Fixes security issue 2.2 for regular grid values
Sanitize tag output in tagging_common and user.tags_used; protect against closing tags in bootstrapped JSON (http://benalpert.com/2012/08/03/preventing-xss-json.html); minor fixes
Prevent XSS in unknown tool display, update to actually use show_error_message instead of replying with plain text.
Fix to 04a072e98658: remove unnecessary replace
Another instance of tool_id reflected xss (in data_source_redirect).
Referer-in-okmessage reflective xss fix
Referer-in-logout reflective xss fix.
Security, UI: minor fixes to history, dataset, and page escaping; escape js tag and annotation displays
Pages: Sanitize name column in items grid
DatasetMatcher should check to see if hda is of the correct format before attempting to filter on e.g. metadata attributes (that may not exist for a non-expected format).
Validate that toolbox filters specified by the user have been configured by the administrator.
propagate the commit of 795336f22d8b94b86256b1d4738ee1bf24e18b57 that is already in next-stable to the stable
original commit msg:
none of the requests & forms controllers used escaping so I escaped the variables exclusively in the templates
Update tag latest_2014.10.06 for changeset 546ff6ef27b4
Merged in martenson/galaxy-central-marten/stable (pull request #585)

[STABLE] propagate the commit of 795336f22d8b94b86256b1d4738ee1bf24e18b57 that is already in next-stable to the stable
Remaining user function template XSS cleanup. Also fix login redirection security in the OpenID methods.
Update tag latest_2014.10.06 for changeset 0e663285c743
Merged in dan/galaxy-central-prs/stable (pull request #584)

[STABLE] DatasetMatcher should check to see if hda is of the correct format before attempting to filter on e.g. metadata attributes (that may not exist for a non-expected format).
Fix for DynamicOptions AdditionalValueFilter when columns have not been assigned and to give value preference over name.