escape json value in relation template (#598)

Author: jowilf

starlette_admin/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.15.0rc0"
+__version__ = "0.15.0rc1"
 
 from ._types import ExportType as ExportType
 from ._types import RequestAction as RequestAction

starlette_admin/templates/forms/relation.html

@@ -8,7 +8,7 @@
             class="form-control {{ 'field-has-one' if not field.many else 'field-has-many' }} {% if error %}is-invalid{% endif %}"
             data-url="{{ url_for(__name__ ~ ':api', identity=foreign_model.identity) }}"
             data-pk="{{ fpk }}"
-            {% if data %}data-initial="{{ (data if field.multiple else [data]) |tojson }}" {% endif %}
+            {% if data %}data-initial="{{ (data if field.multiple else [data]) |tojson |forceescape }}" {% endif %}
             {% if field.multiple %}multiple{% endif %}>
     </select>
     {% if field.help_text %}