From ebdbda1bdc5791f4a53ef8dbd0724d3751cfb678 Mon Sep 17 00:00:00 2001
From: Dannon Baker <dannon.baker@gmail.com>
Date: Mon, 8 Dec 2014 17:16:21 -0500
Subject: [PATCH] One more place we shouldn't trust user_email.

---
 templates/refresh_frames.mako | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/refresh_frames.mako b/templates/refresh_frames.mako
index a9ccd292035..ef745d152b1 100644
--- a/templates/refresh_frames.mako
+++ b/templates/refresh_frames.mako
@@ -21,7 +21,7 @@
         ## Refresh masthead == user changes (backward compatibility)
         if ( parent.user_changed ) {
             %if trans.user:
-                parent.user_changed( "${trans.user.email}", ${int( app.config.is_admin_user( trans.user ) )} );
+                parent.user_changed( "${trans.user.email | h }", ${int( app.config.is_admin_user( trans.user ) )} );
             %else:
                 parent.user_changed( null, false );
             %endif