Escape HTML in MessageList_SubjectWidget (fixes #1234)

Bitmessage · Apr 26, 2019 · e3344ad · e3344ad
1 parent 38f36d7
commit e3344ad
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/bitmessageqt/foldertree.py b/src/bitmessageqt/foldertree.py
@@ -4,6 +4,8 @@
 """
 # pylint: disable=too-many-arguments,bad-super-call,attribute-defined-outside-init
 
+from cgi import escape
+
 from PyQt4 import QtCore, QtGui
 
 from bmconfigparser import BMConfigParser
@@ -456,6 +458,8 @@ def data(self, role):
         """Return object data (QT UI)"""
         if role == QtCore.Qt.UserRole:
             return self.subject
+        if role == QtCore.Qt.ToolTipRole:
+            return escape(self.subject)
         return super(MessageList_SubjectWidget, self).data(role)
 
     # label (or address) alphabetically, disabled at the end