various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/issues/_history.rhtml

@@ -6,6 +6,6 @@
 	<% end %>
 	</ul>
 	<% if journal.notes? %>
-    	<%= simple_format auto_link journal.notes %>
+    	<%= simple_format auto_link h(journal.notes) %>
 	<% end %>
 <% end %>