escaping label when form is init (#251)

hasgeek · Jan 9, 2020 · cdd54e2 · cdd54e2
1 parent 2553644
commit cdd54e2
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/baseframe/forms/patch_wtforms.py b/baseframe/forms/patch_wtforms.py
@@ -6,6 +6,7 @@
 
 from __future__ import absolute_import
 
+from flask import escape
 import wtforms
 
 __all__ = []
@@ -47,7 +48,7 @@ def field_init(
 
         original_field_init(
             self,
-            label,
+            escape(label),  # wtforms<3.0 doesn't escape label text
             validators,
             filters=filters,
             description=description,