sehmaschine/django-grappelli — pull request #257 by gavinwahl (2012-12-25 00:58:34+00:00)
Title: Fix XSS in admin header

The `firstof` template tag does not html escape its arguments, so when
using it to output something like a user's name, it must be wrapped with
`force_escape`.