Ensures data-disable-with attribute is properly escaped when uery links are rendered (#42238).

Patch by Holger Just (user:hjust).


git-svn-id: https://svn.redmine.org/redmine/trunk@23522 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/helpers/queries_helper.rb

@@ -510,7 +510,7 @@ module QueriesHelper
                               url_params.merge(:query_id => query),
                               :class => css,
                               :title => query.description,
-                              :data => { :disable_with => query.name }) +
+                              :data => { :disable_with => CGI.escapeHTML(query.name) }) +
                         clear_link.html_safe)
         end.join("\n").html_safe,
         :class => 'queries'