From 1fffee7e5d8df220d411ba646000d9e5f749aaee Mon Sep 17 00:00:00 2001
From: Ryan Lerch <rlerch@redhat.com>
Date: Sep 26 2018 13:33:02 +0000
Subject: Fix escaping on PR diffs


Fixes #3719

---

diff --git a/pagure/ui/filters.py b/pagure/ui/filters.py
index 2b1b59b..c8f56bd 100644
--- a/pagure/ui/filters.py
+++ b/pagure/ui/filters.py
@@ -224,17 +224,18 @@ def format_loc(
                 output.append(
                     '<td class="cell2 stretch-table-column">\
                     <pre class="alert-success"><code>%s</code></pre></td>'
-                    % line
+                    % escape(line)
                 )
             elif line.startswith("-"):
                 output.append(
                     '<td class="cell2 stretch-table-column">\
                     <pre class="alert-danger"><code>%s</code></pre></td>'
-                    % line
+                    % escape(line)
                 )
         else:
             output.append(
-                '<td class="cell2"><pre><code>%s</code></pre></td>' % line
+                '<td class="cell2"><pre><code>%s</code></pre></td>'
+                % (escape(line))
             )
 
         output.append("</tr>")