escape role names in auth/admin

diff --git a/ipf/auth/admin.php b/ipf/auth/admin.php
index e7fe4e28806e5c46774788cce8169c16a5c42aa4..b4679e572f9c7c64acdb6d46383b82422f85cd1f 100644 (file)
--- a/ipf/auth/admin.php
+++ b/ipf/auth/admin.php
@@ -163,7 +163,7 @@ class AdminUser extends \IPF_Admin_Component
 
     public function column_groups($obj)
     {
-        return implode(' / ', \PFF\Arr::pluck($obj->roles(), 'name'));
+        return Text::escape(implode(' / ', \PFF\Arr::pluck($obj->roles(), 'name')));
     }
 
     function _searchFields()
@@ -294,7 +294,7 @@ class AdminRole extends \IPF_Admin_Component
 
     public function renderCell($object, $column)
     {
-        return $object->$column;
+        return Text::escape($object->$column);
     }
 
     function _searchFields()