select2: always escape .text attributes to prevent XSS via

vcs references.

rhodecode/public/js/src/rhodecode.js

@@ -241,7 +241,7 b' var formatSelect2SelectionRefs = functio'
   } else if (commit_ref.type === 'book'){
     tmpl = tmpl.concat('<i class="icon-bookmark"></i> ');
   }
-  return tmpl.concat(commit_ref.text);
+  return tmpl.concat(escapeHtml(commit_ref.text));
 };
 
 // takes a given html element and scrolls it down offset pixels

rhodecode/public/js/src/rhodecode/select2_widgets.js

@@ -35,7 +35,6 b' var select2RefBaseSwitcher = function(ta'
   $(targetElement).select2({
     cachedDataSource: {},
     dropdownAutoWidth: true,
-    formatResult: formatResult,
     width: "resolve",
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
@@ -59,11 +58,10 b' var select2RefBaseSwitcher = function(ta'
         });
       }
     },
-
     initSelection: function(element, callback) {
       callback(initialData);
     },
-
+    formatResult: formatResult,
     formatSelection: formatSelection
   });