various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/issues/change_status.rhtml

@@ -1,4 +1,4 @@
-<h2><%=l(:label_issue)%> #<%= @issue.id %>: <%= @issue.subject %></h2>
+<h2><%=l(:label_issue)%> #<%= @issue.id %>: <%=h @issue.subject %></h2>
 
 <%= error_messages_for 'issue' %>
 <%= start_form_tag({:action => 'change_status', :id => @issue}, :class => "tabular") %>