Merge pull request #3791 from galaxyproject/release_16.10

merge 16.10 into 17.01

lib/galaxy/web/framework/helpers/grids.py

@@ -565,7 +565,7 @@ def get_value( self, trans, grid, item ):
                 ann_snippet += "..."
         else:
             ann_snippet = ""
-        return ann_snippet
+        return escape( ann_snippet )
 
     def get_single_filter( self, user, a_filter ):
         """ Filter by annotation and annotation owner. """