bravecollective/core — pull request #175 by jboning (2014-05-05 08:52:07+00:00)
Title: Add escaping in a bunch of places

This does not solve everything, but it's a big step. Improving on this
will probably require fixing the confirm dialog.

Longer term steps:
- Don't substitute values into JS. Move JS out of templates to help
this not happen accidentally.
- Move to a templating language that automatically does context-aware
escaping. Because it's not the 1990s.