security: fixed XSS inside the tooltip for author string.

rhodecode/lib/helpers.py

@@ -894,7 +894,8 b' def author_string(email):'
         user = User.get_by_email(email, case_insensitive=True, cache=True)
         if user:
             if user.firstname or user.lastname:
-                return '%s %s <%s>' % (user.firstname, user.lastname, email)
+                return '%s %s <%s>' % (
+                    escape(user.firstname), escape(user.lastname), email)
             else:
                 return email
         else: