workitems: HTML-escape text fields

diff --git a/workitems.py b/workitems.py
index aa21e656cec1df48c7080e1832149689948945b5..6e5777daae087f763910e58f7c3e39918d51814c 100755 (executable)
--- a/workitems.py
+++ b/workitems.py
@@ -2,6 +2,7 @@
 
 import urllib, re, sys, optparse, os.path, datetime
 import sqlite3 as dbapi2
+from xml.sax.saxutils import escape
 
 blueprints_base_url = 'https://blueprints.launchpad.net'
 
@@ -439,11 +440,11 @@ def html(db):
         if bp.startswith('http:'):
             url = bp
         else:
-            url = '%s/ubuntu/+spec/%s' % (blueprints_base_url, bp)
+            url = '%s/ubuntu/+spec/%s' % (blueprints_base_url, escape(bp))
         print '  <tr><td><a href="%s">%s</a></td> <td>%i/%i/%i</td> <td>%i%%</td> <td>%s</td></tr>' % (
-                url, bp, data[bp][0], data[bp][2],
+                url, escape(bp), data[bp][0], data[bp][2],
                 data[bp][1], percent,
-                data[bp][-1])
+                escape(data[bp][-1]))
 
     print '</table>'
 
@@ -464,7 +465,7 @@ def html(db):
     for (a, percent) in completion:
         url = '%s/~%s/+specs?role=assignee' % (blueprints_base_url, a)
         print '  <tr><td><a href="%s">%s</a></td> <td>%i/%i/%i</td> <td>%i%%</td></tr>' % (
-                url, a, data[a][0], data[a][2],
+                url, escape(a), data[a][0], data[a][2],
                 data[a][1], percent)
     print '</table>'