--- a/common/uilib.py	Thu Apr 30 13:05:40 2009 +0200
+++ b/common/uilib.py	Thu Apr 30 13:06:10 2009 +0200
@@ -41,7 +41,7 @@
         # don't translate empty value if you don't want strange results
         if props is not None and value and props.get('internationalizable'):
             return req._(value)
-        
+
         return value
     if attrtype == 'Date':
         return ustrftime(value, req.property_value('ui.date-format'))
@@ -63,12 +63,12 @@
 # text publishing #############################################################
 
 try:
-    from cubicweb.common.rest import rest_publish # pylint: disable-msg=W0611
+    from cubicweb.ext.rest import rest_publish # pylint: disable-msg=W0611
 except ImportError:
     def rest_publish(entity, data):
         """default behaviour if docutils was not found"""
-        return data
-    
+        return html_escape(data)
+
 TAG_PROG = re.compile(r'</?.*?>', re.U)
 def remove_html_tags(text):
     """Removes HTML tags from text
@@ -201,7 +201,7 @@
     return text[:length] + u'...'
 
 
-    
+
 # HTML generation helper functions ############################################
 
 def simple_sgml_tag(tag, content=None, **attrs):
@@ -246,7 +246,7 @@
     >>> ajax_replace_url('foo', 'Person P', 'oneline', name='bar', age=12)
     "javascript: replacePageChunk('foo', 'Person%20P', 'oneline', {'age':12, 'name':'bar'});"
     >>> ajax_replace_url('foo', 'Person P', name='bar', age=12)
-    "javascript: replacePageChunk('foo', 'Person%20P', 'null', {'age':12, 'name':'bar'});"    
+    "javascript: replacePageChunk('foo', 'Person%20P', 'null', {'age':12, 'name':'bar'});"
     """
     params = [repr(nodeid), repr(urlquote(rql))]
     if extraparams and not vid:
@@ -315,7 +315,7 @@
         else:
             for child in path[-1].children:
                 build_matrix(path[:] + [child], matrix)
-        
+
     matrix = []
     build_matrix([tree], matrix)
 
@@ -347,9 +347,9 @@
             if link_type == 0 and i > 0 and links[i-1][j] in (1, 2, 3):
                 link_type = 2
             links[-1].append(link_type)
-    
+
 
-    # We can now generate the HTML code for the <table> 
+    # We can now generate the HTML code for the <table>
     s = u'<table class="tree">\n'
     if caption:
         s += '<caption>%s</caption>\n' % caption
@@ -369,7 +369,7 @@
                 s += '<td rowspan="2">&nbsp;</td>'
             s += '<td class="tree_cell_%d_1">&nbsp;</td>' % link_cell
             s += '<td class="tree_cell_%d_2">&nbsp;</td>' % link_cell
-                
+
         cell = line[-1]
         if cell:
             if cell.id == selected_node:
@@ -459,7 +459,7 @@
                            (boxid, ''.join(html_info)))
             tcbk = tcbk.tb_next
         except Exception:
-            pass # doesn't really matter if we have no context info    
+            pass # doesn't really matter if we have no context info
     strings.append(u'</div>')
     return '\n'.join(strings)
 
@@ -467,7 +467,7 @@
 
 class UnicodeCSVWriter:
     """proxies calls to csv.writer.writerow to be able to deal with unicode"""
-    
+
     def __init__(self, wfunc, encoding, **kwargs):
         self.writer = csv.writer(self, **kwargs)
         self.wfunc = wfunc