pull request: urlify PRs and fix javascript injection

rhodecode/templates/pullrequests/pullrequest_show.html

@@ -81,7 +81,7 b''
               <label>${_('Description')}:</label>
           </div>
           <div class="input">
-              <div style="white-space:pre-wrap">${h.literal(c.pull_request.description)}</div>
+              <div style="white-space:pre-wrap">${h.urlify_commit(c.pull_request.description)}</div>
           </div>
          </div>
          <div class="field">