From 412b96ba55f1a67b0390f72249db9b7fe890b768 Mon Sep 17 00:00:00 2001
From: Damien Churchill <damoxc@gmail.com>
Date: Tue, 27 Apr 2010 10:24:16 +0100
Subject: [PATCH] xml escape notifications sent via libnotify (Closes: #1185)

---
 deluge/common.py                | 34 +++++++++++++++++++++++++++++++++
 deluge/ui/gtkui/notification.py | 14 ++++++++------
 2 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/deluge/common.py b/deluge/common.py
index 3b4f3bd1f..985773b2e 100644
--- a/deluge/common.py
+++ b/deluge/common.py
@@ -550,6 +550,40 @@ def path_join(*parts):
             path += '/' + part
     return path
 
+XML_ESCAPES = ( 
+    ('&', '&amp;'),
+    ('<', '&lt;'),
+    ('>', '&gt;'),
+    ('"', '&quot;'),
+    ("'", '&apos;')
+)
+
+def xml_decode(string):
+    """ 
+    Unescape a string that was previously encoded for use within xml.
+    
+    :param string: The string to escape
+    :type string: string
+    :returns: The unescaped version of the string.
+    :rtype: string
+    """
+    for char, escape in XML_ESCAPES:
+        string = string.replace(escape, char)
+    return string
+
+def xml_encode(string):
+    """ 
+    Escape a string for use within an xml element or attribute.
+    
+    :param string: The string to escape
+    :type string: string
+    :returns: An escaped version of the string.
+    :rtype: string
+    """
+    for char, escape in XML_ESCAPES:
+        string = string.replace(char, escape)
+    return string
+
 class VersionSplit(object):
     """
     Used for comparing version numbers.
diff --git a/deluge/ui/gtkui/notification.py b/deluge/ui/gtkui/notification.py
index e5af16861..fe2d1e0e9 100644
--- a/deluge/ui/gtkui/notification.py
+++ b/deluge/ui/gtkui/notification.py
@@ -74,12 +74,14 @@ class Notification:
             except:
                 log.warning("pynotify is not installed")
             else:
-                if pynotify.init("Deluge"):
-                    self.note = pynotify.Notification(_("Torrent complete"),
-                        status["name"] + "\n" + _("Including %i files" % status["num_files"]))
-                    self.note.set_icon_from_pixbuf(common.get_logo(48))
-                    if not self.note.show():
-                        log.warning("pynotify failed to show notification")
+                if not pynotify.init("Deluge"):
+                    return
+                title = deluge.common.xml_encode(_("Torrent complete"))
+                message = deluge.common.xml_encode(status["name"] + "\n" + _("Including %i files" % status["num_files"]))
+                self.note = pynotify.Notification(title, message)
+                self.note.set_icon_from_pixbuf(common.get_logo(48))
+                if not self.note.show():
+                    log.warning("pynotify failed to show notification")
 
     def sound(self):
         """plays a sound when a torrent finishes"""