fix xss (#2060)

templates/activity/delete.html.twig

@@ -9,24 +9,22 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%activity%': '<strong>' ~ activity.name ~ '</strong>',
-        '%project%': '<strong>-</strong>',
-        '%customer%': '<strong>-</strong>',
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%activity%': activity.name,
+        '%project%': '-',
+        '%customer%': '-',
+        '%records%': stats.recordAmount,
+        '%duration%': stats.recordDuration|duration
     } %}
 
     {% if activity.project is not null %}
         {% set params = params|merge({
-            '%project%': '<strong>' ~ activity.project.name ~ '</strong>',
-            '%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
+            '%project%': activity.project.name,
+            '%customer%': activity.project.customer.name,
         }) %}
     {% endif %}
 
-    {% set message = '<p>' ~ ("admin_activity.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_activity.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_activity')