Issue #3625451: security and bug fixes:

- escape entries in the admin report
- correctly apply block title placeholders