various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/models/custom_field.rb

@@ -28,6 +28,7 @@ class CustomField < ActiveRecord::Base
 
   validates_presence_of :name, :field_format
   validates_uniqueness_of :name
+  validates_format_of :name, :with => /^[\w\s\'\-]*$/i
   validates_inclusion_of :field_format, :in => FIELD_FORMATS.keys
   validates_presence_of :possible_values, :if => Proc.new { |field| field.field_format == "list" }