From 83bb289de36c45cbd9c89ea70049857727d70d4e Mon Sep 17 00:00:00 2001
From: Mark Hanna <mark@skvare.com>
Date: Tue, 23 May 2017 21:17:52 -0500
Subject: [PATCH] CRM-20046 escaping item titles in recently viewed block

---
 templates/CRM/Block/RecentlyViewed.tpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/CRM/Block/RecentlyViewed.tpl b/templates/CRM/Block/RecentlyViewed.tpl
index e49739dad4..34c66ee4c6 100644
--- a/templates/CRM/Block/RecentlyViewed.tpl
+++ b/templates/CRM/Block/RecentlyViewed.tpl
@@ -27,7 +27,7 @@
 <div id="crm-recently-viewed" class="left crm-container">
     <ul>
     {foreach from=$recentlyViewed item=item}
-         <li class="crm-recently-viewed" ><a  href="{$item.url}" title="{$item.title}">
+         <li class="crm-recently-viewed" ><a  href="{$item.url}" title="{$item.title|escape:'html'}">
          {if $item.image_url}
             <span class="icon crm-icon {if $item.subtype}{$item.subtype}{else}{$item.type}{/if}-icon" style="background: url('{$item.image_url}')"></span>
          {else}
-- 
2.25.1