werein/x-editable-rails — pull request #40 by 13k (2014-06-24 04:30:14+00:00)
Title: Removes unsafe use of `html_safe`.

Any user content (thus unknown) should not be `html_safe`'ed. The `html_safe` should be applied only by the data owner. Clients (like x-editable-rails) should never trust external data.

The issue can be seen here: https://github.com/werein/x-editable-rails/pull/30#issuecomment-46929420

User provided values that are already `html_safe`'ed are respected (as demonstrated by tests).

Fixes #30