Security Release for issue #14363

Abdulfatah Abdillahi has found that sao does not escape the completion values . The content of completion is generally the record name which may be edited in many ways depending on the model. The content may include some JavaScript which is executed in the same context as sao which gives access to sensitive data such as the session.