From 736b54991043cb76ceea46564b984fc8832a3602 Mon Sep 17 00:00:00 2001
From: Don Allingham <don@gramps-project.org>
Date: Sun, 28 Jan 2007 05:08:49 +0000
Subject: [PATCH] 	* src/ReportBase/_ReportOptions.py: (#877) escape XML
 constructs 	* src/BaseDoc.py: escape XML constructs

svn: r8000
---
 ChangeLog                        |  2 ++
 src/BaseDoc.py                   | 10 +++++++---
 src/ReportBase/_ReportOptions.py | 22 +++++++++++++---------
 3 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 14b2533c0..5a2aee81d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,6 @@
 2007-01-27  Don Allingham  <don@gramps-project.org>
+	* src/ReportBase/_ReportOptions.py: (#877) escape XML constructs
+	* src/BaseDoc.py: escape XML constructs
 	* src/DataViews/_PersonView.py: add enter to collapse row as well
 
 2007-01-27  Benny Malengier  <benny.malengier@ugent.be>
diff --git a/src/BaseDoc.py b/src/BaseDoc.py
index 4ca70f1cb..d0dde455e 100644
--- a/src/BaseDoc.py
+++ b/src/BaseDoc.py
@@ -67,6 +67,10 @@ __revision__ = "Revision:$Id$"
 #-------------------------------------------------------------------------
 import os
 from math import pi, cos, sin
+from xml.sax.saxutils import escape
+
+def escxml(d):
+    return escape(d, { '"' : '&quot;' } )
 
 #-------------------------------------------------------------------------
 #
@@ -872,10 +876,10 @@ class StyleSheetList:
             if name == "default":
                 continue
             sheet = self.map[name]
-            xml_file.write('<sheet name="%s">\n' % name)
+            xml_file.write('<sheet name="%s">\n' % escxml(name))
             for p_name in sheet.get_names():
                 para = sheet.get_style(p_name)
-                xml_file.write('<style name="%s">\n' % p_name)
+                xml_file.write('<style name="%s">\n' % escxml(p_name))
                 font = para.get_font()
                 xml_file.write('<font face="%d" ' % font.get_type_face())
                 xml_file.write('size="%d" ' % font.get_size())
@@ -890,7 +894,7 @@ class StyleSheetList:
                 tmargin = float(para.get_top_margin())
                 bmargin = float(para.get_bottom_margin())
                 padding = float(para.get_padding())
-                xml_file.write('description="%s" ' % para.get_description())
+                xml_file.write('description="%s" ' % escxml(para.get_description()))
                 xml_file.write('rmargin="%s" ' % Utils.gformat(rmargin))
                 xml_file.write('lmargin="%s" ' % Utils.gformat(lmargin))
                 xml_file.write('first="%s" ' % Utils.gformat(findent))
diff --git a/src/ReportBase/_ReportOptions.py b/src/ReportBase/_ReportOptions.py
index e860446a1..0461ea204 100644
--- a/src/ReportBase/_ReportOptions.py
+++ b/src/ReportBase/_ReportOptions.py
@@ -31,6 +31,10 @@ Report option handling, including saving and parsing.
 #
 #-------------------------------------------------------------------------
 import os
+from xml.sax.saxutils import escape
+
+def escxml(d):
+    return escape(d, { '"' : '&quot;' } )
 
 #-------------------------------------------------------------------------
 #
@@ -242,31 +246,31 @@ class OptionListCollection(_Options.OptionListCollection):
     def write_common(self,f):
         f.write('<last-common>\n')
         if self.get_last_paper_name() != self.default_paper_name:
-            f.write('  <paper name="%s"/>\n' % self.get_last_paper_name() )
+            f.write('  <paper name="%s"/>\n' % escxml(self.get_last_paper_name()) )
         if self.get_last_template_name() != self.default_template_name:
-            f.write('  <template name="%s"/>\n' % self.get_last_template_name() )
+            f.write('  <template name="%s"/>\n' % escxml(self.get_last_template_name()) )
         if self.get_last_format_name() != self.default_format_name:
-            f.write('  <format name="%s"/>\n' % self.get_last_format_name() )
+            f.write('  <format name="%s"/>\n' % escxml(self.get_last_format_name()) )
         if self.get_last_orientation() != self.default_orientation:
-            f.write('  <orientation value="%d"/>\n' % self.get_last_orientation() )
+            f.write('  <orientation value="%d"/>\n' % escxml(self.get_last_orientation()) )
         f.write('</last-common>\n')
 
     def write_module_common(self,f,option_list):
         if option_list.get_style_name() \
                and option_list.get_style_name() != self.default_style_name:
-            f.write('  <style name="%s"/>\n' % option_list.get_style_name() )
+            f.write('  <style name="%s"/>\n' % escxml(option_list.get_style_name()) )
         if option_list.get_paper_name() \
                and option_list.get_paper_name() != self.default_paper_name:
-            f.write('  <paper name="%s"/>\n' % option_list.get_paper_name() )
+            f.write('  <paper name="%s"/>\n' % escxml(option_list.get_paper_name()) )
         if option_list.get_template_name() \
                and option_list.get_template_name() != self.default_template_name:
-            f.write('  <template name="%s"/>\n' % option_list.get_template_name() )
+            f.write('  <template name="%s"/>\n' % escxml(option_list.get_template_name()) )
         if option_list.get_format_name() \
                and option_list.get_format_name() != self.default_format_name:
-            f.write('  <format name="%s"/>\n' % option_list.get_format_name() )
+            f.write('  <format name="%s"/>\n' % escxml(option_list.get_format_name()) )
         if option_list.get_orientation() \
                and option_list.get_orientation() != self.default_orientation:
-            f.write('  <orientation value="%d"/>\n' % option_list.get_orientation() )
+            f.write('  <orientation value="%d"/>\n' % escxml(option_list.get_orientation()) )
 
     def parse(self):
         """