openmrs/openmrs-core — pull request #447 by MrMarvin (2013-11-09 17:56:43+00:00)
Title: TRUNK-3931 wrapping unescaped ${statement} outputs in <c:out ... />

this seems to fix jira issue #3931 ( https://tickets.openmrs.org/browse/TRUNK-3931 )

```
The create patient flow is allows stored XSS when using the following
name (script is executed when loading mdrtbEditPatient.form, and
potentially other pages that display the patient name).
">
...
```