diff --git a/app/controllers/dmsf_controller.rb b/app/controllers/dmsf_controller.rb
index bab3fc85..4d4f80d5 100644
--- a/app/controllers/dmsf_controller.rb
+++ b/app/controllers/dmsf_controller.rb
@@ -630,7 +630,7 @@ class DmsfController < ApplicationController
         recipients = DmsfMailer.deliver_files_deleted(@project, deleted_files)
         if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
           if recipients.any?
-            to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+            to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
             to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
             flash[:warning] = l(:warning_email_notifications, to: to)
           end
diff --git a/app/controllers/dmsf_files_controller.rb b/app/controllers/dmsf_files_controller.rb
index c67cb933..f85b23fe 100644
--- a/app/controllers/dmsf_files_controller.rb
+++ b/app/controllers/dmsf_files_controller.rb
@@ -178,7 +178,7 @@ class DmsfFilesController < ApplicationController
               recipients = DmsfMailer.deliver_files_updated(@project, [@file])
               if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
                 if recipients.any?
-                  to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+                  to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
                   to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
                   flash[:warning] = l(:warning_email_notifications, to: to)
                 end
@@ -208,7 +208,7 @@ class DmsfFilesController < ApplicationController
             recipients = DmsfMailer.deliver_files_deleted(@project, [@file])
             if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
               if recipients.any?
-                to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+                to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
                 to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
                 flash[:warning] = l(:warning_email_notifications, to: to)
               end
diff --git a/app/controllers/dmsf_workflows_controller.rb b/app/controllers/dmsf_workflows_controller.rb
index 395de8c9..18588dd0 100644
--- a/app/controllers/dmsf_workflows_controller.rb
+++ b/app/controllers/dmsf_workflows_controller.rb
@@ -84,7 +84,7 @@ class DmsfWorkflowsController < ApplicationController
                     :text_email_to_see_history)
                 if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
                   unless recipients.blank?
-                    to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+                    to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
                     to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
                     flash[:warning] = l(:warning_email_notifications, to: to)
                   end
@@ -105,7 +105,7 @@ class DmsfWorkflowsController < ApplicationController
                     action.note)
                 if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
                   unless recipients.blank?
-                    to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+                    to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
                     to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
                     flash[:warning] = l(:warning_email_notifications, to: to)
                   end
@@ -126,7 +126,7 @@ class DmsfWorkflowsController < ApplicationController
                     action.note,
                     action.dmsf_workflow_step_assignment.dmsf_workflow_step)
                   if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
-                    flash[:warning] = l(:warning_email_notifications, to: delegate.name)
+                    flash[:warning] = l(:warning_email_notifications, to: h(delegate.name))
                   end
                 end
               else
@@ -164,7 +164,7 @@ class DmsfWorkflowsController < ApplicationController
                       recipients.uniq!
                       recipients = recipients & DmsfMailer.get_notify_users(@project, [revision.dmsf_file], true)
                       unless recipients.empty?
-                        to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+                        to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
                         to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
                         flash[:warning] = l(:warning_email_notifications, to: to)
                       end
diff --git a/app/helpers/dmsf_upload_helper.rb b/app/helpers/dmsf_upload_helper.rb
index f29267ba..aacc8f98 100644
--- a/app/helpers/dmsf_upload_helper.rb
+++ b/app/helpers/dmsf_upload_helper.rb
@@ -152,7 +152,7 @@ module DmsfUploadHelper
           recipients = DmsfMailer.deliver_files_updated(project, files)
           if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
             unless recipients.empty?
-              to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+              to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
               to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
               controller.flash[:warning] = l(:warning_email_notifications, to: to) if controller
             end
diff --git a/app/models/dmsf_workflow.rb b/app/models/dmsf_workflow.rb
index 83e3ef46..fa2a03a0 100644
--- a/app/models/dmsf_workflow.rb
+++ b/app/models/dmsf_workflow.rb
@@ -223,7 +223,7 @@ class DmsfWorkflow < ActiveRecord::Base
         assignments.first&.dmsf_workflow_step)
     if Setting.plugin_redmine_dmsf['dmsf_display_notified_recipients']
       unless recipients.blank?
-        to = recipients.collect{ |r| r.name }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
+        to = recipients.collect{ |r| h(r.name) }.first(DMSF_MAX_NOTIFICATION_RECEIVERS_INFO).join(', ')
         to << ((recipients.count > DMSF_MAX_NOTIFICATION_RECEIVERS_INFO) ? ',...' : '.')
         controller.flash[:warning] = l(:warning_email_notifications, to: to) if controller
       end