FIX Escaping in "dependent pages" (SS-2013-009)

code/model/SiteTree.php

@@ -1827,8 +1827,20 @@ class SiteTree extends DataObject implements PermissionProvider,i18nEntityProvid
 			);
 			$dependentTable->getConfig()->getComponentByType('GridFieldDataColumns')
 				->setFieldFormatting(array(
-				'Title' => '<a href=\"admin/pages/edit/show/$ID\">$Title</a>',
-				'AbsoluteLink' => '<a href=\"$value\">$value</a>',
+					'Title' => function($value, &$item) {
+						return sprintf(
+							'<a href=\"admin/pages/edit/show/%d\">%s</a>',
+							(int)$item->ID,
+							Convert::raw2xml($item->Title)
+						);
+					},
+					'AbsoluteLink' => function($value, &$item) {
+						return sprintf(
+							'<a href=\"%s\">%s</a>',
+							Convert::raw2xml($value),
+							Convert::raw2xml($value)
+						);
+					}
 				));
 		}