Escaping strings and screenshot URL on Themes screen

[audrasjb]

Thanks for the ticket and patch,

Just noting that the content of $active_class is generated by the following code:

	$active_class = '';
	if ( $theme['active'] ) {
		$active_class = ' active';
	}

Therefore, there is no way to anyone one to inject anything in this variable, so the current code seems 100% safe :)

[audrasjb]

Concerning the screenshot URL, if we want to escape late the URL, we'll probably want to do it in the template model too:

	<# if ( data.screenshot[0] ) { #>
		<div class="theme-screenshot">
			<img src="{{ data.screenshot[0] }}" alt="" />
		</div>
	<# } else { #>
		<div class="theme-screenshot blank"></div>
	<# } #>