Main page: message

- enable HTML escaping for the message parameter
- this is to prevent XSS vulnerability such as
  UniTime/main.action?message=%3Cscript%3Ealert(%22test%22);%3C/script%3E

WebContent/main.jsp

@@ -28,7 +28,7 @@
 	<s:set var="showBackground" value="false"/>
 	<div class='messages'>
 		<div class='WelcomeRowHead'><loc:message name="sectSystemMessages"/></div>
-		<div class='message'><s:property value="message" escapeHtml="false"/></div>
+		<div class='message'><s:property value="message"/></div>
 	</div>
 </s:if>
 <tt:registration method="hasMessage">