# HG changeset patch
# User Aurelien Campeas <aurelien.campeas@logilab.fr>
# Date 1263402269 -3600
# Node ID b8ea99f5e8eaed1ae1fff64c67d8b7ae93edd100
# Parent  da84ca26896d83f1bec5925a3b35c9e9f2f8586d
missing xml escapes (but textoutofcontext probably ought to be just outofcontext, with no escaping then)

diff -r da84ca26896d -r b8ea99f5e8ea web/views/editforms.py
--- a/web/views/editforms.py	Tue Jan 12 17:24:46 2010 +0100
+++ b/web/views/editforms.py	Wed Jan 13 18:04:29 2010 +0100
@@ -91,8 +91,8 @@
         w(u'<ul>\n')
         for entity in self.rset.entities():
             # don't use outofcontext view or any other that may contain inline edition form
-            w(u'<li>%s</li>' % tags.a(entity.view('textoutofcontext'),
-                                      href=entity.absolute_url()))
+            w(u'<li>%s</li>' % tags.a(xml_escape(entity.view('textoutofcontext')),
+                                      href=xml_escape(entity.absolute_url())))
         w(u'</ul>\n')
         w(form.render())