SECURITY: prevent iframe in expanded quote
Merge remote-tracking branch 'origin/stable' into pkgr