Cross-Site Scripting

Flower, before 0.9.2, has a XSS on tasks page because data is not properly escaped...