CRM-20301 backport for 4.6

diff --git a/templates/CRM/Contact/Form/Selector.tpl b/templates/CRM/Contact/Form/Selector.tpl
index fed3fe34ff7d5aade0164f3d5b807f75568a2ecd..3665191dd79788b7f136d580d804485e7f3423aa 100644 (file)
--- a/templates/CRM/Contact/Form/Selector.tpl
+++ b/templates/CRM/Contact/Form/Selector.tpl
@@ -97,7 +97,7 @@
             <td><a href="{crmURL p='civicrm/contact/view' q="reset=1&cid=`$row.contact_id`&key=`$qfKey`&context=`$context`"}">{if $row.is_deleted}<del>{/if}{$row.sort_name}{if $row.is_deleted}</del>{/if}</a></td>
             {if $action eq 512 or $action eq 256}
               {if !empty($columnHeaders.street_address)}
-          <td><span title="{$row.street_address}">{$row.street_address|mb_truncate:22:"...":true}{if $row.do_not_mail} <span class="icon privacy-flag do-not-mail"></span>{/if}</span></td>
+          <td><span title="{$row.street_address|escape}">{$row.street_address|mb_truncate:22:"...":true}{if $row.do_not_mail} <span class="icon privacy-flag do-not-mail"></span>{/if}</span></td>
         {/if}
         {if !empty($columnHeaders.city)}
                 <td>{$row.city}</td>
@@ -113,7 +113,7 @@
               {/if}
               <td>
                 {if $row.email}
-                    <span title="{$row.email}">
+                    <span title="{$row.email|escape}">
                         {$row.email|mb_truncate:17:"...":true}
                         {if $row.on_hold}
                           (On Hold)<span class="status-hold" title="{ts}This email is on hold (probably due to bouncing).{/ts}"></span>