Merge pull request #3776 from martenson/xss-fix

[16.04] fix xss vuln in grids

lib/galaxy/web/framework/helpers/grids.py

@@ -565,7 +565,7 @@ def get_value( self, trans, grid, item ):
                 ann_snippet += "..."
         else:
             ann_snippet = ""
-        return ann_snippet
+        return escape( ann_snippet )
 
     def get_single_filter( self, user, a_filter ):
         """ Filter by annotation and annotation owner. """