gems-uff/sapos — pull request #72 by tiagoamaro (2013-10-16 02:26:36+00:00)
Title: Escape HTML tags in Log View

When a field with HTML appears in the Log view, the HTML isn't escaped, allowing XSS attacks.

How to test:
Edit any field of a model with text "Word1\Word2"
Edit again to any other value.
Open Versions page: /versions
Click in "View" and it shows in the Old Version:
field: Word1
Word2