Use instance variable instead of param

Prevent unescaped user input.

Co-authored-by: Eduardo Navarro <enavarro@suse.com>
Co-authored-by: Henne Vogelsang <hvogel@opensuse.org>

src/api/app/controllers/webui/users/notifications_controller.rb

@@ -9,6 +9,7 @@ def index
     @notifications = fetch_notifications
     @projects_for_filter = projects_for_filter
     @notifications_count = notifications_count
+    @filtered_project = Project.find_by(name: params[:project])
   end
 
   def update

src/api/app/views/webui/users/notifications/index.html.haml

@@ -8,7 +8,7 @@
     .card.mb-3
       %strong.d-block.d-md-none.p-3{ data: { toggle: 'collapse', target: '#filters' },
                                   aria: { expanded: true, controls: 'filters' } }
-        Filtered by: #{params[:type]&.humanize || params[:project] || 'Unread'}
+        Filtered by: #{params[:type]&.humanize || @filtered_project || 'Unread'}
         %i.float-right.mt-1.fa.fa-chevron-down
       .card-body.collapse#filters
         = render partial: 'notifications_filter', locals: { projects_for_filter: @projects_for_filter, notifications_count: @notifications_count }