dualfroz bb891e182e fix(security): escape the project name in the analytic modal title ...

LayoutHelper::analytic() prefixes the title with the raw project name, and
the AJAX branch of analytic/layout.php printed that title as is, so a
project name containing markup was injected into the analytic modals.

Escape it with $this->text->e() like the other layouts do. It does not
double-encode, so the ">" separator still renders as ">".

2026-10-03 15:58:07 +02:00

..

layout.php

fix(security): escape the project name in the analytic modal title

2026-10-03 15:58:07 +02:00