We take the simple/cheap way out and use ExtJS htmlEncode on all
entry points for this.
This is still mostly limited to 'doing it to yourself'.
The main fix is in app/view/main/Main.js where the title is rendered
out, and will apparently execute arbitrary javascript within a title
tag(!). This is an ExtJS thing, apparently, so we make it
unconditionally encode it to render on the bar.
Apparently this isn't the only place arbitrary execution can occur,
so just be safe(r).
TheGoddessInari
_nderscore
Ramiro Saenz
Maxime Myers