Merge pull request #3095 from modoboa/fix/xss_profile_form

Fixed XSS vulnerability when displaying form error messages.

modoboa/static/js/twocols_nav.js

@@ -30,7 +30,7 @@ TwocolsNav.prototype = {
     listen: function() {
         $("a.ajaxnav").click($.proxy(this.load_section, this));
         $(document).on("click", "#update", $.proxy(function(e) {
-            var $form = $("form").first();
+            var $form = $(e.target).closest("form");
             simple_ajax_form_post(e, {
                 formid: $form.attr("id"),
                 modal: false,

modoboa/templates/common/generic_field.html

@@ -12,7 +12,7 @@
     {% endif %}
   </label>
   {% endif %}
-  
+
   <div class="{% render_field_width field %}">
     {% if appended_text %}
     <div class="input-group">
@@ -31,7 +31,7 @@
     {% if field.errors %}
     <p class="help-block">
       {% for error in field.errors %}
-      {{ error|safe }}
+      {{ error }}
       {% endfor %}
     </p>
     {% endif %}