Merge remote-tracking branch 'openaustralia_github/rails_xss' into develop

1 files changed, 2 insertions, 2 deletions

diff --git a/app/models/info_request.rb b/app/models/info_request.rb
index 3355b9443..cee9eb959 100644
--- a/app/models/info_request.rb
+++ b/app/models/info_request.rb
@@ -284,9 +284,9 @@ public
         # into some sort of separate jurisdiction dependent file
         if self.public_body.url_name == 'general_register_office'
             # without GQ in the subject, you just get an auto response
-            _('{{law_used_full}} request GQ - {{title}}',:law_used_full=>self.law_used_full,:title=>self.title)
+            _('{{law_used_full}} request GQ - {{title}}',:law_used_full=>self.law_used_full,:title=>self.title.html_safe)
         else
-            _('{{law_used_full}} request - {{title}}',:law_used_full=>self.law_used_full,:title=>self.title)
+            _('{{law_used_full}} request - {{title}}',:law_used_full=>self.law_used_full,:title=>self.title.html_safe)
         end
     end
     def email_subject_followup(incoming_message = nil)