fix(security): Prevent XSS in (edit|view)barmenu (closes #4996)