Ampersands in names are not escaped in member list
Detailed description of the issue. Provide as much information as you can, potentially with images showing the issue.
Steps to reproduce:
- Open Fractal
- Enter #riot-dev:matrix.org
- Open member list, search for "adam"
- Wait a while
- Notice that other names become bold, except "&Adam".
Console gets filled with the warning (fractal:2828): Gtk-WARNING **: Failed to set text '<b>&Adam</b>' from markup due to error parsing markup: Error on line 1: Entity did not end with a semicolon; most likely you used an ampersand character without intending to start an entity - escape ampersand as &
This even seems like a potential vector for injection, as the remote-user provided name is not sanitized before used as HTML(?)