Phalcon\Tag::getTitle should escape content

[kristofferingemansson]

Title generation with Phalcon\Tag is subject to XSS when used with user generated content.
Automatic escaping needs to be added.

$maliciousContent = "</title><script>alert('Got your nose!');</script><title>";
$tag = \Phalcon\Di::getDefault()->getShared('tag');
$tag->prependTitle("Hello $maliciousContent!");
print $tag->getTitle();

Actual:

<title>Hello </title><script>alert('Got your nose!');</script><title>!</title>

Expected:

<title>Hello &lt;/title>&lt;script>alert('Got your nose!');&lt;/script>&lt;title>!</title>

Phalcon 2.0.8 WIN32, running on PHP 5.5.24 CLI, Windows 7 Pro x64

[sergeyklay]

Thanks. Fixed in 2.0.x branch.