Merge remote-tracking branch 'origin/2.0' into 2.0

src/Http/Controllers/PermissionController.php

@@ -33,7 +33,9 @@ class PermissionController extends AdminController
             $tree->disableEditButton();
 
             $tree->branch(function ($branch) {
-                $payload = "<div class='pull-left' style='min-width:310px'><b>{$branch['name']}</b>&nbsp;&nbsp;[<span class='text-primary'>{$branch['slug']}</span>]";
+                $branchName = htmlspecialchars($branch['name']);
+                $branchSlug = htmlspecialchars($branch['slug']);
+                $payload = "<div class='pull-left' style='min-width:310px'><b>{$branchName}</b>&nbsp;&nbsp;[<span class='text-primary'>{$branchSlug}</span>]";
 
                 $path = array_filter($branch['http_path']);