Also escape in clone path

acl/log_parser.pl

@@ -27,7 +27,8 @@ if ($action eq 'modify') {
 	}
 elsif ($action eq 'create') {
 	if ($p->{'clone'}) {
-		return &text('log_clone'.$g, "<tt>$p->{'clone'}</tt>",
+		return &text('log_clone'.$g,
+			     "<tt>".&html_escape($p->{'clone'})."</tt>",
 			     "<tt>".&html_escape($object)."</tt>");
 		}
 	else {

acl/t/run-tests.t

@@ -941,6 +941,12 @@ is(group_line({ name => 'empty' }),
     for my $case (
         [ 'delete user',
           [ 'admin', 's', 'delete', 'user', $payload, {} ] ],
+        [ 'create with clone (clone source)',
+          [ 'admin', 's', 'create', 'user', 'safe',
+            { clone => $payload } ] ],
+        [ 'create with clone (new name)',
+          [ 'admin', 's', 'create', 'user', $payload,
+            { clone => 'safe' } ] ],
         [ 'modify rename (old name)',
           [ 'admin', 's', 'modify', 'user', 'safe',
             { old => $payload, name => 'safe' } ] ],