various modifications to prevent xss

- validation of names and labels against /^[\w\s\'\-]*$/i
- html entities encoding

git-svn-id: http://redmine.rubyforge.org/svn/trunk@99 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/views/welcome/index.rhtml

@@ -4,14 +4,7 @@
   <% if $RDM_WELCOME_TEXT %><p><%= $RDM_WELCOME_TEXT %></p><br /><% end %>
   <div class="box">
 	<h3><%=l(:label_news_latest)%></h3>
-		<% for news in @news %>
-			<p>
-			<b><%= news.title %></b> (<%= link_to_user news.author %> <%= format_time(news.created_on) %> - <%= news.project.name %>)<br />
-			<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
-			[<%= link_to l(:label_read), :controller => 'news', :action => 'show', :id => news %>]
-			</p>
-			<hr />
-		<% end %>
+		<%= render :partial => 'news/news', :collection => @news %>
 	</div>
 </div>
 
@@ -22,7 +15,7 @@
 		<% for project in @projects %>
 			<li>
 			<%= link_to project.name, :controller => 'projects', :action => 'show', :id => project %> (<%= format_time(project.created_on) %>)<br />
-			<%= project.description %>
+			<%=h project.description %>
 			</li>
 		<% end %>
 		</ul>