fix: escape project name and task subject in project portal templates

erpnext/templates/includes/projects/project_row.html

@@ -6,7 +6,7 @@
         {{ doc.name }}
       </div>
       <div class="col-xs-2 project-name">
-        {{ doc.project_name }}
+        {{ doc.project_name | e }}
       </div>
       <div class="col-xs-3 text-center">
         {% if doc.percent_complete %}

erpnext/templates/includes/projects/project_tasks.html

@@ -8,7 +8,7 @@
           <svg class="icon icon-xs"><use href="#icon-corner-down-right"></use></svg>
         </span>
       {% endif %}
-      {{ task.subject }}</a>
+      {{ task.subject | e }}</a>
   </div>
   <div class="col-sm-2">{{ task.status }}</div>
   <div class="col-sm-2 small text-muted">

erpnext/templates/pages/projects.html

@@ -1,7 +1,7 @@
 {% extends "templates/web.html" %}
 
 {% block title %}
-  {{ doc.project_name }}
+  {{ doc.project_name | e }}
 {% endblock %}
 
 {% block head_include %}
@@ -9,7 +9,7 @@
 {% endblock %}
 
 {% block header %}
-  <h3 class="my-account-header">{{ doc.project_name }}</h3>
+  <h3 class="my-account-header">{{ doc.project_name | e }}</h3>
 {% endblock %}
 
 {% block style %}