Merge branch 'hotfix/0.4.1.1' into develop

Conflicts:
	Changelog.md
	config/defaults.yml

Changelog.md

@@ -60,6 +60,10 @@ The default for including jQuery from a CDN has changed. If you want to continue
 * Increase possible captcha length [#5169](https://github.com/diaspora/diaspora/pull/5169)
 * Display visibility icon in publisher aspects dropdown [#4982](https://github.com/diaspora/diaspora/pull/4982)
 
+# 0.4.1.1
+
+* Fix XSS issue in poll questions [#5274](https://github.com/diaspora/diaspora/issues/5274)
+
 # 0.4.1.0
 
 ## New 'Terms of Service' feature and template

app/assets/templates/poll_tpl.jst.hbs

@@ -1,7 +1,7 @@
 {{#if poll}}
   <div class="poll_form">
     <div class="row-fluid poll_head">
-      <strong>{{{poll.question}}}</strong>
+      <strong>{{poll.question}}</strong>
       <div class="poll_statistic pull-right">
         {{t "poll.count" count=poll.participation_count}}
       </div>
@@ -12,13 +12,13 @@
           {{#poll.poll_answers}}
             <label class="radio result-row">
               <input type="radio" name="vote" value="{{id}}"/>
-              {{answer}} 
+              {{answer}}
               <span class="percentage pull-right" style="display: none;"></span>
               <div class="poll_progress_bar_wrapper progress" style="display: none">
                 <div class="poll_progress_bar bar" data-answerid="{{id}}">
               </div>
             </div>
-            </label>  
+            </label>
           {{/poll.poll_answers}}
           <div class="toggle_result_wrapper">
             <a class="toggle_result" href="#">{{t "poll.show_result"}}</a>

spec/javascripts/app/views/poll_view_spec.js

@@ -35,6 +35,15 @@ describe("app.views.Poll", function(){
     })
   });
 
+  describe("render", function() {
+    it("escapes the poll question", function() {
+      var question = "<script>alert(0);</script>";
+      this.view.poll.question = question;
+      this.view.render();
+      expect(this.view.$('.poll_head strong').text()).toBe(question);
+    });
+  });
+
   describe("vote form", function(){
     it('show vote form when user is logged in and not voted before', function(){
       expect(this.view.$('form').length).toBe(1);