comments: escape file-paths on commenting to prevent html breakage

rhodecode/public/js/src/rhodecode/comments.js

@@ -670,7 +670,7 b' var CommentsController = function() {'
           var lineno = self.getLineNumber(node);
           // create a new HTML from template
           var tmpl = $('#cb-comment-inline-form-template').html();
-          tmpl = tmpl.format(f_path, lineno);
+          tmpl = tmpl.format(escapeHtml(f_path), lineno);
           $form = $(tmpl);
 
           var $comments = $td.find('.inline-comments');