filters: Escape State names when generating selector HTML

States with names containing special characters are not correctly escaped
when generating the select list. Use escape() to fix this.

Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>

diff --git a/patchwork/filters.py b/patchwork/filters.py
index e2d2f5958dd4642a19d085c3da951d6308d1e1c7..fb644f98213634fc5d933a6be5e2ef386df328f0 100644 (file)
--- a/patchwork/filters.py
+++ b/patchwork/filters.py
@@ -262,7 +262,7 @@ class StateFilter(Filter):
                 selected = ' selected="true"'
 
             out += '<option value="%d" %s>%s</option>' % (
-                state.id, selected, state.name)
+                state.id, selected, escape(state.name))
         out += '</select>'
         return mark_safe(out)