escape customer, project and activity name in javascript (#2959)

assets/js/KimaiPlugin.js

@@ -66,4 +66,19 @@ export default class KimaiPlugin {
         return this.getContainer().getPlugin(name);
     }
 
+    /**
+     * @param {string} title
+     * @returns {string}
+     */
+    escape(title) {
+        const tagsToReplace = {
+            '&': '&',
+            '<': '&lt;',
+            '>': '&gt;',
+        };
+
+        return title.replace(/[&<>]/g, function(tag) {
+            return tagsToReplace[tag] || tag;
+        });
+    };
 }

assets/js/plugins/KimaiRecentActivities.js

@@ -65,9 +65,10 @@ export default class KimaiRecentActivities extends KimaiPlugin {
 
         for (let timesheet of entries) {
             let label = this.attributes['template']
-                .replace('%customer%', timesheet.project.customer.name)
-                .replace('%project%', timesheet.project.name)
-                .replace('%activity%', timesheet.activity.name);
+                .replace('%customer%', this.escape(timesheet.project.customer.name))
+                .replace('%project%', this.escape(timesheet.project.name))
+                .replace('%activity%', this.escape(timesheet.activity.name))
+            ;
 
             htmlToInsert +=
                 `<li>` +