Merge pull request #37 from jenkinsci-cert/SECURITY-214

[SECURITY-214] OfflineCause.toString() is a string, not necessarily HTML

core/src/main/java/hudson/node_monitors/ResponseTimeMonitor.java

@@ -188,7 +188,7 @@ public class ResponseTimeMonitor extends NodeMonitor {
         }
 
         /**
-         * HTML rendering of the data
+         * String rendering of the data
          */
         @Override
         public String toString() {
@@ -200,7 +200,7 @@ public class ResponseTimeMonitor extends NodeMonitor {
 //            return buf.toString();
             int fc = failureCount();
             if(fc>0)
-                return Util.wrapToErrorSpan(Messages.ResponseTimeMonitor_TimeOut(fc));
+                return Messages.ResponseTimeMonitor_TimeOut(fc);
             return getAverage()+"ms";
         }
 

core/src/main/resources/hudson/slaves/OfflineCause/cause.jelly

@@ -24,5 +24,5 @@ THE SOFTWARE.
 
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <p class="warning"><j:out value="${it}" /></p>
+  <p class="warning">${it}</p>
 </j:jelly>