Escaping in html email templates (#4874).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3452 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/mailer/message_posted.text.html.rhtml

@@ -1,4 +1,4 @@
-<h1><%=h @message.board.project.name %> - <%=h @message.board.name %>: <%= link_to @message.subject, @message_url %></h1>
-<em><%= @message.author %></em>
+<h1><%=h @message.board.project.name %> - <%=h @message.board.name %>: <%= link_to(h(@message.subject), @message_url) %></h1>
+<em><%=h @message.author %></em>
 
 <%= textilizable(@message, :content, :only_path => false) %>