edx/edx-platform — pull request #4749 by waheedahmed (2014-08-08 07:38:28+00:00)
Title: Html escaped from display name in xblock.

LMS-11194

You can set the Display Name on any xblock, and it will render the raw text, not escaped. This allows any HTML tags, including script injection.