From: David Mazary <dmazary@gmail.com>
Date: Thu, 15 Mar 2012 01:15:04 +0000 (-0300)
Subject: use cgi.escape to escape &,<,>
X-Git-Url: https://git.rm.cloudns.org/?a=commitdiff_plain;h=e424832ecf1191abbe4c8622d17f0a3faecc1ae1;p=xonotic%2Fxonstat.git

use cgi.escape to escape &,<,>
---

diff --git a/xonstat/util.py b/xonstat/util.py
index 758b206..23d9e28 100755
--- a/xonstat/util.py
+++ b/xonstat/util.py
@@ -1,4 +1,5 @@
 import re
+from cgi import escape
 from datetime import datetime
 
 # Map of special chars to ascii from Darkplace's console.c.
@@ -78,7 +79,7 @@ def strip_colors(qstr=''):
 
 
 def html_colors(qstr=''):
-    qstr = qfont_decode(qstr)
+    qstr = escape(qfont_decode(qstr))
     def dec_repl(match):
         return _dec_spans[int(match.group(1))]
     qstr = qstr.replace('^^', '^')