Description of problem:
There is a possible XSS when you create group with HTML via SSM or API and checks snapshot with this group join/leave.


Version-Release number of selected component (if applicable):
spacewalk-java-2.3.8-134.el6sat.noarch


How reproducible:
always


Steps to Reproduce:
1. Use SSM to create group:
   Systems -> System Set Manager -> Groups -> Create Group
     Name: '"><script>alert()</script>'
     Description: whatever
   OR use API to create such a group:
     client.systemgroup.create(key, 'bz"><script>alert("created name")</script>', 'bz"><script>alert("created desc")</script>')
2. Choose system and make sure it have Provisioning add-on entitlement
3. Systems -> <system> -> Groups -> Join -> select group you have created
   in step "1."
4. Systems -> <system> -> Provisioning -> Snapshots -> <newest_one> -> Groups
5. Ensure you see that group from step "1." there. If you are not, find
   the snapshot where you can see it (if you made more actions with the
   system, this might not be trivial :-))


Actual results:
If you are in correct snapshot (see step "5."), JavaScript alert appears.


Expected results:
Group name is properly escaped.


Additional info:
Found when working on bug 1320452.