In review UIs, the caption text was getting double escaped. The reason for this

was that we used a template to dump it into javascript, which would escape it

once, and then called $.text(), which would escape it a second time. The fix

here is to use the escapejs filter when templating the value into javascript.

Created a file attachment with a caption that had some quotes in it, and

verified that the visible header in the review UI didn't have the literal

""".