HTML-escape page title in watchlist JSON response (Bug 1472439)

Change-Id: I445c763b09928ce03ae8561605e593bc23bba122
(cherry picked from commit 539d323f)

htdocs/view/togglewatchlist.json.php

@@ -31,7 +31,7 @@ if (!can_view_view($view)) {
     json_reply('local', $result);
 }
 
-$title = $view->get('title');
+$title = hsc($view->get('title'));
 
 if (get_record('usr_watchlist_view', 'usr', $data->usr, 'view', $viewid)) {
     if (!delete_records('usr_watchlist_view', 'usr', $data->usr, 'view', $viewid)) {