Fix XSS in Ponder

Summary: See rP883829e6676fc3412b83b6ab16f7bf5b56b174b8

Test Plan: Verified no XSS with a title like `<b>!</b>`.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4534

src/applications/ponder/view/PonderUserProfileView.php

@@ -84,7 +84,7 @@ final class PonderUserProfileView extends AphrontView {
             array(
               'href' => '/Q'.$question->getID(),
             ),
-            self::abbreviate($question->getTitle()))));
+            phutil_escape_html(self::abbreviate($question->getTitle())))));
 
       $view->addItem($item);
     }