From d01c9599bd6d7eaa83f56f5d235b5d8d3f1374ee Mon Sep 17 00:00:00 2001
From: Matias Griese <matias@trilbymedia.com>
Date: Mon, 16 Nov 2020 15:41:16 +0200
Subject: [PATCH] Escape page title in `pages` field

---
 CHANGELOG.md                                             | 1 +
 themes/grav/templates/forms/fields/pages/pages.html.twig | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 47396cb2..930d6a49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@
     * Allow to fallback to `docs:` instead of `readme:`
     * Backported finder/pages navigation from 1.10 (you will still need 1.10 for the fancy Parent Picker)
     * Forward a `sid` to GPM when downloading a premium package
+    * Escape page title in `pages` field
 
 # v1.9.17
 ## 10/07/2020
diff --git a/themes/grav/templates/forms/fields/pages/pages.html.twig b/themes/grav/templates/forms/fields/pages/pages.html.twig
index ea31356a..ddaebf00 100644
--- a/themes/grav/templates/forms/fields/pages/pages.html.twig
+++ b/themes/grav/templates/forms/fields/pages/pages.html.twig
@@ -10,7 +10,7 @@
     {% endif %}
 
     {% for page_route, option in pages_list %}
-        <option {% if page_route == value or (field.multiple and page_route in value) %}selected="selected"{% endif %} value="{{ page_route }}">{{ option|raw }}</option>
+        <option {% if page_route == value or (field.multiple and page_route in value) %}selected="selected"{% endif %} value="{{ page_route }}">{{ option }}</option>
     {% endfor %}
 {% endmacro %}