xml escape notifications sent via libnotify (Closes: #1185)

deluge/common.py

@@ -550,6 +550,40 @@ def path_join(*parts):
             path += '/' + part
     return path
 
+XML_ESCAPES = ( 
+    ('&', '&'),
+    ('<', '&lt;'),
+    ('>', '&gt;'),
+    ('"', '&quot;'),
+    ("'", '&apos;')
+)
+
+def xml_decode(string):
+    """ 
+    Unescape a string that was previously encoded for use within xml.
+    
+    :param string: The string to escape
+    :type string: string
+    :returns: The unescaped version of the string.
+    :rtype: string
+    """
+    for char, escape in XML_ESCAPES:
+        string = string.replace(escape, char)
+    return string
+
+def xml_encode(string):
+    """ 
+    Escape a string for use within an xml element or attribute.
+    
+    :param string: The string to escape
+    :type string: string
+    :returns: An escaped version of the string.
+    :rtype: string
+    """
+    for char, escape in XML_ESCAPES:
+        string = string.replace(char, escape)
+    return string
+
 class VersionSplit(object):
     """
     Used for comparing version numbers.

deluge/ui/gtkui/notification.py

@@ -74,12 +74,14 @@ class Notification:
             except:
                 log.warning("pynotify is not installed")
             else:
-                if pynotify.init("Deluge"):
-                    self.note = pynotify.Notification(_("Torrent complete"),
-                        status["name"] + "\n" + _("Including %i files" % status["num_files"]))
-                    self.note.set_icon_from_pixbuf(common.get_logo(48))
-                    if not self.note.show():
-                        log.warning("pynotify failed to show notification")
+                if not pynotify.init("Deluge"):
+                    return
+                title = deluge.common.xml_encode(_("Torrent complete"))
+                message = deluge.common.xml_encode(status["name"] + "\n" + _("Including %i files" % status["num_files"]))
+                self.note = pynotify.Notification(title, message)
+                self.note.set_icon_from_pixbuf(common.get_logo(48))
+                if not self.note.show():
+                    log.warning("pynotify failed to show notification")
 
     def sound(self):
         """plays a sound when a torrent finishes"""