From 0ab13c248239ebb116d081b69a0632731155cb40 Mon Sep 17 00:00:00 2001
From: Shengjing Zhu <zsj950618@gmail.com>
Date: Jun 01 2017 10:08:56 +0000
Subject: Fix plain readme html escape.


We put content in pre tag, thus we need to escape the content.

Closes: #1831

Signed-off-by: Shengjing Zhu <zsj950618@gmail.com>

---

diff --git a/pagure/doc_utils.py b/pagure/doc_utils.py
index 0145a80..9d0d483 100644
--- a/pagure/doc_utils.py
+++ b/pagure/doc_utils.py
@@ -12,6 +12,7 @@
 import docutils
 import docutils.core
 import docutils.examples
+import jinja2
 import kitchen.text.converters as ktc
 import markupsafe
 import textwrap
@@ -80,7 +81,7 @@ def convert_doc(rst_string, view_file_url=None):
             writer_name='html',
             settings_overrides=overrides)
     except:
-        return '<pre>%s</pre>' % rst
+        return '<pre>%s</pre>' % jinja2.escape(rst)
 
     else:
 
@@ -106,7 +107,7 @@ def convert_readme(content, ext, view_file_url=None):
         safe = True
     elif not ext or (ext and ext in ['.text', '.txt']):
         safe = True
-        output = '<pre>%s</pre>' % output
+        output = '<pre>%s</pre>' % jinja2.escape(output)
     return output, safe