XSS issue in modules.haml

[btsibr]

modules.haml echos the user's query back without escaping, resulting in a XSS vulnerability

We've patched the acute issue by adding: - query = CGI::escape(query)

Not being a Rails expert, I'm not sure if there is a better way to:

• Properly escape the query value
• Ensure that everything is escaped by default
• Ensure that information from module metadata.json is scrubbed/escaped as well

[i11]

Fixed by the https://github.com/unibet/puppet-forge-server/pull/65