Fix a script injection attack in diff fragments.
Fix a script injection attack in diff fragments.

When rendering a diff fragment, the user-specified 'index' value was not
checked for malicious/incorrect content, and was then directly embedded
straight into the page. This allowed an attacker to craft a URL with
custom HTML and pass it to another user (such as through an iframe),
running the custom code in their session.

The fix is simple. We just want to make sure that the index value
specified is a valid integer, and disregard it if not.

This vulnerability was found by Uchida.

Reviewed at https://reviews.reviewboard.org/r/6126/

KnowNo/reviewboard,1tush/reviewboard,bkochendorfer/reviewboard,bkochendorfer/reviewboard,reviewboard/reviewboard,sgallagher/reviewboard,1tush/reviewboard,beol/reviewboard,1tush/reviewboard,reviewboard/reviewboard,1tush/reviewboard,chipx86/reviewboard,KnowNo/reviewboard,1tush/reviewboard,bkochendorfer/reviewboard,beol/reviewboard,1tush/reviewboard,custode/reviewboard,1tush/reviewboard,custode/reviewboard,KnowNo/reviewboard,brennie/reviewboard,bkochendorfer/reviewboard,reviewboard/reviewboard,brennie/reviewboard,chipx86/reviewboard,brennie/reviewboard,davidt/reviewboard,davidt/reviewboard,brennie/reviewboard,beol/reviewboard,custode/reviewboard,sgallagher/reviewboard,1tush/reviewboard,davidt/reviewboard,beol/reviewboard,custode/reviewboard,reviewboard/reviewboard,KnowNo/reviewboard,chipx86/reviewboard,davidt/reviewboard,chipx86/reviewboard,sgallagher/reviewboard,sgallagher/reviewboard,1tush/reviewboard