Index: lams_central/conf/language/lams/ApplicationResources.properties
===================================================================
diff -u -r661c831ee553050b1fa07b90b529b82bdff71612 -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_central/conf/language/lams/ApplicationResources.properties	(.../ApplicationResources.properties)	(revision 661c831ee553050b1fa07b90b529b82bdff71612)
+++ lams_central/conf/language/lams/ApplicationResources.properties	(.../ApplicationResources.properties)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -442,6 +442,6 @@
 error.firstname.invalid.characters  =First name contains invalid characters
 error.lastname.invalid.characters  =Last name contains invalid characters
 error.username.invalid.characters  =Username can only contain alphanumeric characters and no spaces.
+error.lessonname.invalid.characters  =Lesson name contains invalid characters
 
-
 #======= End labels: Exported 436 labels for en AU =====
Index: lams_central/web/addLesson.jsp
===================================================================
diff -u -r79add7aa4fc06ca2cc260306f2e33f987a0b4bcb -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_central/web/addLesson.jsp	(.../addLesson.jsp)	(revision 79add7aa4fc06ca2cc260306f2e33f987a0b4bcb)
+++ lams_central/web/addLesson.jsp	(.../addLesson.jsp)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -23,24 +23,25 @@
 	<script type="text/javascript" src="includes/javascript/yui/treeview-min.js" ></script>
 	<script type="text/javascript" src="includes/javascript/addLesson.js"></script>
 	<script type="text/javascript">
-		var userId = '<lams:user property="userID"/>';
-		var folderContents = ${folderContents};
-		var users = ${users};
-		
-		var LAMS_URL = '<lams:LAMSURL/>';
-		var LD_THUMBNAIL_URL_BASE = LAMS_URL + 'home.do?method=createLearningDesignThumbnail&ldId=';
+		var userId = '<lams:user property="userID"/>',
+			folderContents = ${folderContents},
+			users = ${users},
+			
+			LAMS_URL = '<lams:LAMSURL/>',
+			LD_THUMBNAIL_URL_BASE = LAMS_URL + 'home.do?method=createLearningDesignThumbnail&ldId=',
+			
+			CANVAS_RESIZE_OPTION_NONE = 0,
+			CANVAS_RESIZE_OPTION_FIT = 1,
+			CANVAS_RESIZE_OPTION_FULL = 2,
+			CANVAS_RESIZE_LABEL_FULL = '<fmt:message key="label.tab.lesson.size.full" />',
+			CANVAS_RESIZE_LABEL_FIT = '<fmt:message key="label.tab.lesson.size.fit" />',
 
-		var CANVAS_RESIZE_OPTION_NONE = 0;
-		var CANVAS_RESIZE_OPTION_FIT = 1;
-		var CANVAS_RESIZE_OPTION_FULL = 2;
-		var CANVAS_RESIZE_LABEL_FULL = '<fmt:message key="label.tab.lesson.size.full" />';
-		var CANVAS_RESIZE_LABEL_FIT = '<fmt:message key="label.tab.lesson.size.fit" />';
-
-		var SPLIT_LEARNERS_DESCRIPTION = '<fmt:message key="label.tab.advanced.split.desc" />';
-		var LABEL_MISSING_LEARNERS = '<fmt:message key="error.tab.class.learners" />';
-		var LABEL_MISSING_MONITORS = '<fmt:message key="error.tab.class.monitors" />';
-		var LABEL_RUN_SEQUENCES_FOLDER = '<fmt:message key="label.tab.lesson.sequence.folder" />';
-		
+			SPLIT_LEARNERS_DESCRIPTION = '<fmt:message key="label.tab.advanced.split.desc" />',
+			LABEL_MISSING_LEARNERS = '<fmt:message key="error.tab.class.learners" />',
+			LABEL_MISSING_MONITORS = '<fmt:message key="error.tab.class.monitors" />',
+			LABEL_RUN_SEQUENCES_FOLDER = '<fmt:message key="label.tab.lesson.sequence.folder" />',
+			LABEL_NAME_INVALID_CHARACTERS = '<fmt:message key="error.lessonname.invalid.characters" />';
+				
 		$(document).ready(function(){
 			$('#tabs').tabs();
 			
Index: lams_central/web/includes/javascript/addLesson.js
===================================================================
diff -u -r679fe3220201c33cc6396ef0b3c0592f1da293f6 -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_central/web/includes/javascript/addLesson.js	(.../addLesson.js)	(revision 679fe3220201c33cc6396ef0b3c0592f1da293f6)
+++ lams_central/web/includes/javascript/addLesson.js	(.../addLesson.js)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -263,7 +263,15 @@
 	}
 	$('#ldIdField').val(ldNode.data.learningDesignId);
 	
-	if (!lessonName){
+	if (lessonName){
+		var nameValidator = /^[^<>^*@%$]*$/igm;	
+		if (!nameValidator.test(lessonName)) {
+			$('#lessonNameInput').addClass('errorField');
+			$('#tabs').tabs('option', 'selected', 0);
+			alert(LABEL_NAME_INVALID_CHARACTERS);
+			return;
+		}
+	} else {
 		$('#lessonNameInput').addClass('errorField');
 		$('#tabs').tabs('option', 'selected', 0);
 		return;
Index: lams_central/web/includes/javascript/authoring/authoringGeneral.js
===================================================================
diff -u -r8a39e73cf38d5f62bf4be88f765da4a23da49fff -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_central/web/includes/javascript/authoring/authoringGeneral.js	(.../authoringGeneral.js)	(revision 8a39e73cf38d5f62bf4be88f765da4a23da49fff)
+++ lams_central/web/includes/javascript/authoring/authoringGeneral.js	(.../authoringGeneral.js)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -5,6 +5,7 @@
 // few publicly visible variables 
 var paper = null,
 	canvas = null,
+	nameValidator = /^[^<>^*@%$]*$/igm,
 	
 // configuration and storage of various elements
 	layout = {
@@ -279,12 +280,17 @@
 			            	'click'  : function() {	
 			            		var dialog = $(this),
 			            			container = dialog.closest('.ui-dialog'),
-			            			title = $('#ldStoreDialogNameField', container).val();
+			            			title = $('#ldStoreDialogNameField', container).val().trim();
 			            		if (!title) {
 			            			alert('Please enter a title for the sequence');
 			            			return;
 			            		}
 			            		
+			            		if (!nameValidator.test(title)) {
+			            			alert('Sequence title can not contain any of these characters < > ^ * @ % $');
+			            			return;
+			            		}
+			            		
 			            		var tree = dialog.dialog('option', 'ldTree'),
 			            			node = tree.getHighlightedNode();
 			            		if (!node) {
@@ -434,7 +440,7 @@
 				'maxUIID'		   : 0
 			};
 			
-			$('#ldDescriptionFieldTitle').text(ld.title);
+			$('#ldDescriptionFieldTitle').html(escapeHtml(ld.title));
 			CKEDITOR.instances['ldDescriptionFieldDescription'].setData(ld.description);
 			
 			var arrangeNeeded = false,
@@ -1147,37 +1153,39 @@
 			'ld'			  : JSON.stringify(ld)
 		},
 		success : function(response) {
-			// if save was successful
+			layout.ld.folderID = folderID;
+			layout.ld.title = title;
+			
+			// check if there were any validation errors
+			if (response.validation.length > 0) {
+				var message = 'While saving the sequence there were following validation issues:\n';
+				$.each(response.validation, function() {
+					var uiid = this.UIID,
+						title = '';
+					if (uiid) {
+						// find which activity is the error about
+						$.each(layout.activities, function(){
+							if (uiid == this.uiid) {
+								title = this.title + ': ';
+							}
+						});
+					}
+					message += title + this.message + '\n';
+				});
+				
+				alert(message);
+			}
+			
+			// if save (even partially) was successful
 			if (response.ld) {
 				// assing the database-generated values
 				layout.ld.learningDesignID = response.ld.learningDesignID;
-				layout.ld.folderID = folderID;
-				layout.ld.title = title;
 				if (!layout.ld.contentFolderID) {
 					layout.ld.contentFolderID = response.ld.contentFolderID;
 				}
 				$('#ldDescriptionFieldTitle').text(title);
 				$('#ldDescriptionFieldDescription').text(description);
 				
-				// check if there were any validation errors
-				if (response.validation.length > 0) {
-					var message = 'While saving the sequence there were following validation issues:\n';
-					$.each(response.validation, function() {
-						var uiid = this.UIID,
-							title = '';
-						// find which activity is the error about
-						$.each(layout.activities, function(){
-							if (uiid == this.uiid) {
-								title = this.title + ': ';
-							}
-						});
-						message += title + this.message + '\n';
-					});
-					
-					alert(message);
-					return;
-				}
-				
 				// assign database-generated properties to activities
 				$.each(response.ld.activities, function() {
 					var updatedActivity = this;
@@ -1235,11 +1243,11 @@
 					});
 				});
 				
-				setModified(false);
-				alert('Congratulations! Your design is valid and has been saved.');
-				result = true;
-			} else {
-				alert('Error while saving the sequence');
+				if (response.validation.length == 0) {
+					setModified(false);
+					alert('Congratulations! Your design is valid and has been saved.');
+					result = true;
+				}
 			}
 		},
 		error : function(){
@@ -1315,4 +1323,17 @@
 		$('#exportButton').attr('disabled', null)
 		  				  .css('opacity', 1);
 	}
+}
+
+
+/**
+ * Escapes HTML tags to prevent XSS injection.
+ */
+function escapeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
 }
\ No newline at end of file
Index: lams_central/web/includes/javascript/authoring/authoringProperty.js
===================================================================
diff -u -rdec21a402fc7b42adcf84c15b644228d46a140c7 -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_central/web/includes/javascript/authoring/authoringProperty.js	(.../authoringProperty.js)	(revision dec21a402fc7b42adcf84c15b644228d46a140c7)
+++ lams_central/web/includes/javascript/authoring/authoringProperty.js	(.../authoringProperty.js)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -44,9 +44,23 @@
 			            	'text'   : 'OK',
 			            	'click'  : function() {
 			            		var dialog = $(this),
-			            			activity = dialog.dialog('option', 'parentObject');
+			            			activity = dialog.dialog('option', 'parentObject'),
+			            			error = false;
 			            		
 			            		// extract group names from text fields
+			            		$('input', dialog).each(function(){
+			            			var groupName = $(this).val().trim();
+				            		if (!nameValidator.test(groupName)) {
+				            			alert('Group name can not contain any of these characters < > ^ * @ % $');
+				            			error = true;
+				            			return false;
+				            		}
+			            		});
+			            		
+			            		if (error) {
+			            			return;
+			            		}
+			            		
 			            		$('input', dialog).each(function(index){
 		            				activity.groups[index].groupName = $(this).val().trim();
 			            		});
@@ -163,11 +177,15 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != transition.title) {
-					transition.title = newTitle;
-					if (transition.branch) {
-						transition.branch.title = newTitle;
-					}
-					redrawNeeded = true;
+            		if (!nameValidator.test(newTitle)) {
+            			alert('Transition title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						transition.title = newTitle;
+						if (transition.branch) {
+							transition.branch.title = newTitle;
+						}
+						redrawNeeded = true;
+            		}
 				}
 				
 				if (redrawNeeded) {
@@ -202,8 +220,12 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('Activity title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				
 				var selectedGrouping = $('.propertiesContentFieldGrouping option:selected', content);
@@ -246,8 +268,12 @@
 					redrawNeeded = false,
 					newTitle = $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('Grouping title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				
 				activity.groupingType = $('.propertiesContentFieldGroupingType', content).val();
@@ -341,8 +367,12 @@
 					redrawNeeded = false,
 					newTitle = $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				activity.gateType = $('.propertiesContentFieldGateType', content).val();
 				if (activity.gateType == 'schedule') {
@@ -430,8 +460,12 @@
 					redrawNeeded = false,
 					newTitle = $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != branchingActivity.title) {
-					branchingActivity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						branchingActivity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				branchingActivity.branchingType = $('.propertiesContentFieldBranchingType', content).val();
 				
@@ -493,8 +527,12 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				var newGroupingValue = $('.propertiesContentFieldGrouping option:selected', content)
 									.data('grouping');
@@ -537,10 +575,14 @@
 					activity = content.data('parentObject'),
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != activity.title) {
-					activity.title = newTitle;
-					activity.draw();
-					ActivityLib.addSelectEffect(activity, true);
-					setModified(true);
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						activity.title = newTitle;
+						activity.draw();
+						ActivityLib.addSelectEffect(activity, true);
+						setModified(true);
+            		}
 				}
 			});
 				
@@ -610,8 +652,12 @@
 					color = region.items.shape.attr('fill'),
 					newColor = $('.propertiesContentFieldColor', content).val();
 				if (newTitle != region.title) {
-					region.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						region.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				redrawNeeded |= newColor != color;
 				
@@ -646,8 +692,12 @@
 					redrawNeeded = false,
 					newTitle =  $('.propertiesContentFieldTitle', content).val();
 				if (newTitle != label.title) {
-					label.title = newTitle;
-					redrawNeeded = true;
+					if (!nameValidator.test(newTitle)) {
+            			alert('The title can not contain any of these characters < > ^ * @ % $');
+            		} else {
+						label.title = newTitle;
+						redrawNeeded = true;
+            		}
 				}
 				
 				if (redrawNeeded) {
Index: lams_common/conf/language/lams/ApplicationResources.properties
===================================================================
diff -u -r2db3d8c498bd34aafde968bb05d1e7d4bdec9e50 -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_common/conf/language/lams/ApplicationResources.properties	(.../ApplicationResources.properties)	(revision 2db3d8c498bd34aafde968bb05d1e7d4bdec9e50)
+++ lams_common/conf/language/lams/ApplicationResources.properties	(.../ApplicationResources.properties)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -57,6 +57,7 @@
 validation.error.FloatingActivity  =If you are planning to have support activities you need at least one support activity in the container.
 validation.error.FloatingActivity.maximum  =A maximum of {0} support activities is allow. Please remove one or more support activities.
 validation.error.first.activity  =You need at least one activity in the sequence.
+validation.error.title.characters =The title can not contain any of these characters < > ^ * @ % $
 public.folder.name  =Public Folder
 email.notifications.problems.sending.emails  =Some problems occurred while sending emails. Please, contact your system administrator.
 
Index: lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java
===================================================================
diff -u -r1fe0f4f546903187be6f35e4d5c027853da9408c -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java	(.../ValidationErrorDTO.java)	(revision 1fe0f4f546903187be6f35e4d5c027853da9408c)
+++ lams_common/src/java/org/lamsfoundation/lams/learningdesign/dto/ValidationErrorDTO.java	(.../ValidationErrorDTO.java)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -51,6 +51,7 @@
 	public static final String GROUPING_ACTIVITY_MISSING_GROUPING_KEY = "validation.error.grouping.missing"; // GM
 	public static final String GROUPING_ACTIVITY_GROUP_COUNT_MISMATCH_KEY = "validation.error.group.count.mismatch"; // GC
 	public static final String FIRST_ACTIVITY_ERROR_KEY = "validation.error.first.activity"; // FIA
+	public static final String TITLE_CHARACTERS_ERROR_KEY = "validation.error.title.characters";
 	
 	public static final String BRANCHING_ACTIVITY_MUST_HAVE_A_BRANCH = "validation.error.branching.must.have.a.branch"; // BB
 	public static final String BRANCHING_ACTIVITY_MUST_HAVE_DEFAULT_BRANCH = "validation.error.toolBranchingMustHaveDefaultBranch"; // BDB
@@ -87,6 +88,7 @@
 	public static final String BRANCHING_ACTVITY_TOOLINPUT_ERROR_CODE = "BTI";
 	public static final String BRANCHING_ACTVITY_TOOLCONDITION_ERROR_CODE = "BTC";
 	public static final String FIRST_ACTIVITY_ERROR_CODE = "FIA";
+	public static final String TITLE_CHARACTERS_ERROR_CODE = "TCH";
 	
 	private static MessageResources resources = MessageResources.getMessageResources(ValidationErrorDTO.CONFIG_PARAM);
 	/**
Index: lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java
===================================================================
diff -u -r2f21856ec2ab85b47c93cfcc3fa2c8769be65077 -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java	(.../LearningDesignValidator.java)	(revision 2f21856ec2ab85b47c93cfcc3fa2c8769be65077)
+++ lams_common/src/java/org/lamsfoundation/lams/learningdesign/service/LearningDesignValidator.java	(.../LearningDesignValidator.java)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -39,6 +39,7 @@
 import org.lamsfoundation.lams.learningdesign.Transition;
 import org.lamsfoundation.lams.learningdesign.dto.ValidationErrorDTO;
 import org.lamsfoundation.lams.util.MessageService;
+import org.lamsfoundation.lams.util.ValidationUtil;
 
 /**
  * Validates a learning design. Encapsulates all the validation rules that are "cross activity" for a learning design as
@@ -66,6 +67,11 @@
     public Vector<ValidationErrorDTO> validate() {
 	errors = new Vector<ValidationErrorDTO>(); // initialises the list of validation messages.
 
+	if (!ValidationUtil.isOrgNameValid(learningDesign.getTitle())) {
+	    errors.add(new ValidationErrorDTO(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_CODE, messageService
+		    .getMessage(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_KEY)));
+	}
+
 	// check the design has a starting or first activity
 	if (learningDesign.getFirstActivity() == null) {
 	    errors.add(new ValidationErrorDTO(ValidationErrorDTO.FIRST_ACTIVITY_ERROR_CODE, messageService
@@ -78,6 +84,11 @@
 	validateActivityTransitionRules(topLevelActivities, learningDesign.getTransitions());
 
 	for (Activity activity : (Set<Activity>) learningDesign.getActivities()) {
+	    if (!ValidationUtil.isOrgNameValid(activity.getTitle())) {
+		errors.add(new ValidationErrorDTO(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_CODE, messageService
+			.getMessage(ValidationErrorDTO.TITLE_CHARACTERS_ERROR_KEY), activity.getActivityUIID()));
+	    }
+
 	    checkIfGroupingRequired(activity);
 	    validateGroupingIfGroupingIsApplied(activity);
 	    validateOptionalActivity(activity);
Index: lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java
===================================================================
diff -u -raead34144651a924f76d7bca8645327e6820d226 -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java	(.../MonitoringAction.java)	(revision aead34144651a924f76d7bca8645327e6820d226)
+++ lams_monitoring/src/java/org/lamsfoundation/lams/monitoring/web/MonitoringAction.java	(.../MonitoringAction.java)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -81,6 +81,7 @@
 import org.lamsfoundation.lams.util.ConfigurationKeys;
 import org.lamsfoundation.lams.util.DateUtil;
 import org.lamsfoundation.lams.util.MessageService;
+import org.lamsfoundation.lams.util.ValidationUtil;
 import org.lamsfoundation.lams.util.WebUtil;
 import org.lamsfoundation.lams.util.audit.IAuditService;
 import org.lamsfoundation.lams.util.wddx.FlashMessage;
@@ -278,6 +279,10 @@
     public ActionForward addLesson(ActionMapping mapping, ActionForm form, HttpServletRequest request,
 	    HttpServletResponse response) throws IOException, ServletException, ParseException {
 	String lessonName = request.getParameter("lessonName");
+	if (!ValidationUtil.isOrgNameValid(lessonName)) {
+	    throw new IOException("Lesson name contains invalid characters");
+	}
+	
 	int organisationId = WebUtil.readIntParam(request, AttributeNames.PARAM_ORGANISATION_ID);
 	long ldId = WebUtil.readLongParam(request, AttributeNames.PARAM_LEARNINGDESIGN_ID);
 
Index: lams_monitoring/web/includes/javascript/monitorLesson.js
===================================================================
diff -u -r114f3118210a638741c1e126b27d475c99fb743b -r284923f86a16bfc0fa2681918f532b1eb12ac8b9
--- lams_monitoring/web/includes/javascript/monitorLesson.js	(.../monitorLesson.js)	(revision 114f3118210a638741c1e126b27d475c99fb743b)
+++ lams_monitoring/web/includes/javascript/monitorLesson.js	(.../monitorLesson.js)	(revision 284923f86a16bfc0fa2681918f532b1eb12ac8b9)
@@ -1026,7 +1026,7 @@
 			},
 			'stop' : function(event, ui) {
 				// jQuery droppable does not work for SVG, so this is a workaround
-				forceComplete(activity.id, learner.id, getLearnerDisplayName(learner),
+				forceComplete(activity.id, learner.id, getLearnerDisplayName(learner, true),
 						      ui.offset.left, ui.offset.top);
 			}
 		});
@@ -1095,7 +1095,7 @@
 					},
 					'stop' : function(event, ui) {
 						// jQuery droppable does not work for SVG, so this is a workaround
-						forceComplete(null, learner.id, getLearnerDisplayName(learner),
+						forceComplete(null, learner.id, getLearnerDisplayName(learner, true),
 								      ui.offset.left, ui.offset.top);
 					}
 				})
@@ -1210,7 +1210,7 @@
 			'userId'  : user.id
 			})
           .addClass('dialogListItem')
-	      .text(getLearnerDisplayName(user))
+	      .html(getLearnerDisplayName(user))
 	      .prepend(checkbox)
 	      .appendTo(list);
 		
@@ -1550,7 +1550,7 @@
 									'viewUrl'    : viewUrl
 									})
 			                      .addClass('dialogListItem')
-							      .text(getLearnerDisplayName(learner))
+							      .html(getLearnerDisplayName(learner))
 							      .appendTo(learnerGroupList);
 			
 			if (allowForceComplete || allowView || allowEmail) {
@@ -1594,12 +1594,26 @@
 /**
  * Formats learner name.
  */
-function getLearnerDisplayName(learner) {
-	return learner.firstName + ' ' + learner.lastName + ' (' + learner.login + ')';
+function getLearnerDisplayName(learner, raw) {
+	return raw ? learner.firstName + ' ' + learner.lastName + ' (' + learner.login + ')'
+			   : escapeHtml(learner.firstName) + ' ' + escapeHtml(learner.lastName) + ' (' + escapeHtml(learner.login) + ')';
 }
 
 
 /**
+ * Escapes HTML tags to prevent XSS injection.
+ */
+function escapeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
+}
+
+
+/**
  * Change order of learner sorting in group dialog.
  */
 function sortDialogList(listId) {