edx/edx-platform — pull request #4734 by waheedahmed (2014-08-07 13:42:04+00:00)
Title: Html escaped from display name in xblock.

LMS-11194

You can set the Display Name on any XBlock, and it will render the raw text, not escaped. This allows any HTML tags, including script injection.