XUL-client "stop sign page" does not HTML-escape user-supplied values

[Jason Etheridge]

So, for example, if you give a user an alert message or a standing penalty with a note containing: hello <a href="http://google.com">google</a> world

And you go to the Other -> Display Alerts and Messages (aka Stop Sign Page), you'll see:
hello google world

Clicking on google will load http://google.com/ within the staff client.

This does not happen in the web-based staff client. I've included a quick patch; it may be better to use encodeURI or something, but this seems less messy visually.

[Ben Shum (bshum)]

Assigning initial targets for pushing this through. Because this is a security fix, we may also wish to see this backported to rel_2_6 and a rel_2_6 security release made.

The change is simple enough, but good practice for including in a security dance. Reminder here to push this to the relevant branches prior to the next round of cuts.

[Bill Erickson (berick)]

Patch tested, signed-off, and pushed into security => user/berick/lp1446816-html-escape-stop-page-xul

[Bill Erickson (berick)]

Note, my branch does not contain Jason's sign-off, since the code came from a patch, so it still needs another sign-off.

[Ben Shum (bshum)]

Picked to master and backported to rel_2_8, rel_2_7, and rel_2_6. (though for note, there will not be a 2.6 release since this issue is considered small)