dashboard: fix xss in autocomplete

circle/dashboard/autocomplete_light_registry.py

 import autocomplete_light
 import autocomplete_light
 from django.contrib.auth.models import User
 from django.contrib.auth.models import User
+from django.utils.html import escape
 from django.utils.translation import ugettext as _
 from django.utils.translation import ugettext as _
 
 
 from .views import AclUpdateView
 from .views import AclUpdateView
@@ -23,10 +24,14 @@ class AclUserGroupAutocomplete(autocomplete_light.AutocompleteGenericBase):
             match = None
             match = None
         if q and match is not None:
         if q and match is not None:
             match_end = match + len(q)
             match_end = match + len(q)
-            return (field[:match] + '<span class="autocomplete-hl">' +
-                    field[match:match_end] + '</span>' + field[match_end:])
+            return (escape(field[:match])
+                    + '<span class="autocomplete-hl">'
+                    + escape(field[match:match_end])
+                    + '</span>' + escape(field[match_end:]))
+        elif none_wo_match:
+            return None
         else:
         else:
-            return None if none_wo_match else field
+            return escape(field)
 
 
     def choice_displayed_text(self, choice):
     def choice_displayed_text(self, choice):
         q = unicode(self.request.GET.get('q', ''))
         q = unicode(self.request.GET.get('q', ''))