Escape event titles in year view.

diff --git a/kronolith/js/kronolith.js b/kronolith/js/kronolith.js
index 39147bf..3323732 100644 (file)
--- a/kronolith/js/kronolith.js
+++ b/kronolith/js/kronolith.js
@@ -925,7 +925,7 @@ KronolithCore = {
                     } else {
                         title += event.value.start.toString('t') + '-' + event.value.end.toString('t');
                     }
-                    title += ': ' + event.value.t;
+                    title += ': ' + event.value.t.escapeHTML();
                     if (event.value.x == Kronolith.conf.status.tentative ||
                         event.value.x == Kronolith.conf.status.confirmed) {
                             busy = true;