fix(graph legend): fixed issue with escaping html text in graph legend, and in function param, fixes #3482

public/app/features/templating/templateSrv.js

@@ -79,6 +79,7 @@ function (angular, _) {
     this.highlightVariablesAsHtml = function(str) {
       if (!str || !_.isString(str)) { return str; }
 
+      str = _.escape(str);
       this._regex.lastIndex = 0;
       return str.replace(this._regex, function(match, g1, g2) {
         if (self._values[g1 || g2]) {

public/app/panels/graph/legend.js

@@ -151,7 +151,7 @@ function (angular, _, $) {
             html += '</div>';
 
             html += '<div class="graph-legend-alias">';
-            html += '<a>' + series.label + '</a>';
+            html += '<a>' + _.escape(series.label) + '</a>';
             html += '</div>';
 
             if (panel.legend.values) {