From 60a072824fbd28bd09f54142fc6db10d3a4f6f69 Mon Sep 17 00:00:00 2001
From: Don Allingham <don@gramps-project.org>
Date: Thu, 19 Apr 2007 02:03:29 +0000
Subject: [PATCH] 2007-04-18  Don Allingham  <don@gramps-project.org> 	*
 src/plugins/BookReport.py: escape xml constructs (bug 877) 	*
 src/PluginUtils/_Options.py: escape xml constructs (bug 877)

svn: r8403
---
 ChangeLog                   |  4 ++++
 src/PluginUtils/_Options.py | 13 ++++++++-----
 src/plugins/BookReport.py   | 19 ++++++++++++-------
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 5b50a8e47..b3423c934 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2007-04-18  Don Allingham  <don@gramps-project.org>
+	* src/plugins/BookReport.py: escape xml constructs (bug 877)
+	* src/PluginUtils/_Options.py: escape xml constructs (bug 877)
+
 2007-04-17  Don Allingham  <don@gramps-project.org>
 	* src/Editors/_EditRepository.py: fix double click save bug
 	* src/Editors/_EditSource.py: fix double click save bug
diff --git a/src/PluginUtils/_Options.py b/src/PluginUtils/_Options.py
index 6ece552eb..f6be5cfb3 100644
--- a/src/PluginUtils/_Options.py
+++ b/src/PluginUtils/_Options.py
@@ -44,6 +44,9 @@ except:
     from _xmlplus.sax import make_parser,handler,SAXParseException
     from _xmlplus.sax.saxutils import escape
 
+def escxml(d):
+    return escape(d, { '"' : '&quot;' } )
+
 #-------------------------------------------------------------------------
 #
 # gramps modules
@@ -196,22 +199,22 @@ class OptionListCollection:
 
         for module_name in self.get_module_names():
             option_list = self.get_option_list(module_name)
-            f.write('<module name="%s">\n' % escape(module_name))
+            f.write('<module name="%s">\n' % escxml(module_name))
             options = option_list.get_options()
             for option_name in options.keys():
                 if type(options[option_name]) in (type(list()),type(tuple())):
                     f.write('  <option name="%s" value="" length="%d">\n' % (
-                                escape(option_name),
+                                escxml(option_name),
                                 len(options[option_name]) ) )
                     for list_index in range(len(options[option_name])):
                         f.write('    <listitem number="%d" value="%s"/>\n' % (
                                 list_index,
-                                escape(unicode(options[option_name][list_index]))) )
+                                escxml(unicode(options[option_name][list_index]))) )
                     f.write('  </option>\n')
                 else:
                     f.write('  <option name="%s" value="%s"/>\n' % (
-                            escape(option_name),
-                            escape(unicode(options[option_name]))) )
+                            escxml(option_name),
+                            escxml(unicode(options[option_name]))) )
 
             self.write_module_common(f,option_list)
 
diff --git a/src/plugins/BookReport.py b/src/plugins/BookReport.py
index 6af0d04a3..a12a58a8e 100644
--- a/src/plugins/BookReport.py
+++ b/src/plugins/BookReport.py
@@ -31,6 +31,11 @@
 import os
 from gettext import gettext as _
 
+from xml.sax.saxutils import escape
+
+def escxml(d):
+    return escape(d, { '"' : '&quot;' } )
+
 #------------------------------------------------------------------------
 #
 # Set up logging
@@ -365,28 +370,28 @@ class BookList:
         for name in self.bookmap.keys():
             book = self.get_book(name)
             dbname = book.get_dbname()
-            f.write('<book name="%s" database="%s">\n' % (name,dbname) )
+            f.write('<book name="%s" database="%s">\n' % (escxml(name), escxml(dbname)) )
             for item in book.get_item_list():
                 f.write('  <item name="%s" trans_name="%s">\n' % 
-                            (item.get_name(),item.get_translated_name() ) )
+                            (escxml(item.get_name()), escxml(item.get_translated_name()) ) )
                 option_handler = item.option_class.handler
                 for option_name in option_handler.options_dict.keys():
                     option_value = option_handler.options_dict[option_name]
                     if type(option_value) in (list,tuple):
                         f.write('    <option name="%s" length="%d">\n' % (
-                                option_name, len(option_value) ) )
+                                escxml(option_name), len(option_value) ) )
                         for list_index in range(len(option_value)):
                             option_type = Utils.type_name(option_value[list_index])
                             f.write('      <listitem number="%d" type="%s" value="%s"/>\n' % (
-                                    list_index, option_type, option_value[list_index]) )
+                                    list_index, escxml(option_type), escxml(option_value[list_index])) )
                         f.write('    </option>\n')
                     else:
                         option_type = Utils.type_name(option_value)
                         f.write('    <option name="%s" type="%s" value="%s"/>\n' % (
-                                option_name,option_type,option_value) )
+                                escxml(option_name), escxml(option_type), escxml(option_value)) )
                 f.write('    <person gramps_id="%s"/>\n' % 
-                                        option_handler.get_person_id() )
-                f.write('    <style name="%s"/>\n' % item.get_style_name() )
+                        escxml(option_handler.get_person_id()) )
+                f.write('    <style name="%s"/>\n' % escxml(item.get_style_name()) )
                 f.write('  </item>\n')
             f.write('</book>\n')