Merge branch 'security_fix' into '7.4.0'

HTML injection fix for compose email popup



See merge request !801

layouts/v7/modules/Vtiger/ComposeEmailForm.tpl

@@ -47,7 +47,7 @@
                             </div>
                             <div class="col-lg-6">
                                 {if !empty($TO)}
-                                    {assign var=TO_EMAILS value=","|implode:$TO}
+                                    {assign var=TO_EMAILS value=","|implode:$TO|htmlentities}
                                 {/if}
                                 <input id="emailField" style="width:100%" name="toEmail" type="text" class="autoComplete sourceField select2" data-rule-required="true" data-rule-multiEmails="true" value="{$TO_EMAILS}" placeholder="{vtranslate('LBL_TYPE_AND_SEARCH',$MODULE)}">
                             </div>