diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 1f7d786c..df88838a 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -413,7 +413,7 @@ module ApplicationHelper
title = []
title << h(@project.name) if @project
title += @html_title if @html_title
- title << Setting.app_title
+ title << h(Setting.app_title)
title.select {|t| !t.blank? }.join(' - ')
else
@html_title ||= []
diff --git a/app/views/layouts/base.rhtml b/app/views/layouts/base.rhtml
index 553d743d..3db6b3a1 100644
--- a/app/views/layouts/base.rhtml
+++ b/app/views/layouts/base.rhtml
@@ -2,7 +2,7 @@
-<%=h html_title %>
+<%= html_title %>
<%= csrf_meta_tag %>
diff --git a/test/integration/layout_test.rb b/test/integration/layout_test.rb
index 447ebf80..a19e07bf 100644
--- a/test/integration/layout_test.rb
+++ b/test/integration/layout_test.rb
@@ -60,4 +60,15 @@ class LayoutTest < ActionController::IntegrationTest
:attributes => {:src => %r{^/javascripts/jstoolbar/textile.js}},
:parent => {:tag => 'head'}
end
+
+ test "page titles should be properly escaped" do
+ project = Project.generate(:name => "C&A")
+
+ with_settings :app_title => '<3' do
+ get "/projects/#{project.to_param}"
+
+ assert_select "title", /C&A/
+ assert_select "title", /<3/
+ end
+ end
end