Escape person name in contacts json

jQuery autoSuggest uses .html to insert it into the DOM

1 files changed, 1 insertions, 1 deletions

diff --git a/app/controllers/conversations_controller.rb b/app/controllers/conversations_controller.rb
index 180c42bf6..8322cfb3c 100644
--- a/app/controllers/conversations_controller.rb
+++ b/app/controllers/conversations_controller.rb
@@ -85,7 +85,7 @@ class ConversationsController < ApplicationController
     all_contacts_and_ids = Contact.connection.select_rows(
       current_user.contacts.where(:sharing => true).joins(:person => :profile).
         select("contacts.id, profiles.first_name, profiles.last_name, people.diaspora_handle").to_sql
-    ).map{|r| {:value => r[0], :name => Person.name_from_attrs(r[1], r[2], r[3]).gsub(/(")/, "'")} }
+    ).map{|r| {:value => r[0], :name => ERB::Util.h(Person.name_from_attrs(r[1], r[2], r[3]).gsub(/(")/, "'"))} }
 
     @contact_ids = ""