displayname of the user can contain HTML tags and the string is not filtered in some views

[individual-it]

Describe the bug

The string from 'first and lastname' of a user are shown unfiltered in the notifications
Luckily only the admin can set that data

Steps to reproduce

1. as admin set the first and lastname of einstein to <a href="http://jankari.tech">einstein</a>
2. as einstein share a folder to marie
3. as marie check the notifications

Expected behavior

the HTML string should be encoded as e.g. the sharing dialog

Actual behavior

a link is rendered in the notifications

Setup

Version 	6.4.0
Web client version 	10.2.0

[individual-it]

same thing happens in activities with ocis 6.5.0 & Web UI 10.3.0

[jvillafanez]

Just in case @kulmann isn't aware of this ticket. As far as I know, this needs to be fixed in web.
There is no restrictions on what chars can be on the displayname, so it's up to the client (web in this case) to figure out how to represent all those chars. For example, if we wanted to export the list of users in a CSV file, it's up to the export tool to escape the commas that could be present in the displayname.

[AlexAndBear]

needs html escape in the respective views.
e.G AcitivitesPanel