HTML escaping for python console.

git-svn-id: http://svn.osgeo.org/qgis/trunk/qgis@6874 c8812cc2-4d05-0410-92ff-de0c093fc19c

src/app/qgspythondialog.cpp

@@ -32,6 +32,11 @@ QgsPythonDialog::~QgsPythonDialog()
   QgsPythonUtils::uninstallConsoleHooks();
 }
 
+QString QgsPythonDialog::escapeHtml(QString text)
+{
+    return text.replace("<","&lt;").replace(">","&gt;");
+}
+
 void QgsPythonDialog::on_edtCmdLine_returnPressed()
 {
   QString command = edtCmdLine->text();
@@ -43,12 +48,10 @@ void QgsPythonDialog::on_edtCmdLine_returnPressed()
   {
     QgsPythonUtils::evalString("sys.stdout.data", output);
     QgsPythonUtils::runString("sys.stdout.data = ''");
-    QString result =  QgsPythonUtils::getResult();
+    QString result = QgsPythonUtils::getResult();
     // escape the result so python objects display properly and
     // we can still use html output to get nicely formatted display
-    result.replace("<","&lt;");
-    result.replace(">","&gt;");
-    output += result;
+    output = escapeHtml(output) + escapeHtml(result);
 
     if (!output.isEmpty())
       output += "<br>";
@@ -58,10 +61,10 @@ void QgsPythonDialog::on_edtCmdLine_returnPressed()
     QString className, errorText;
     QgsPythonUtils::getError(className, errorText);
 
-    output = "<font color=\"red\">" + className + ": " + errorText + "</font><br>";
+    output = "<font color=\"red\">" + escapeHtml(className) + ": " + escapeHtml(errorText) + "</font><br>";
   }
 
-  QString str = "<b><font color=\"green\">>>></font> " + command.replace("<","&lt;") + "</b><br>" + output;
+  QString str = "<b><font color=\"green\">>>></font> " + escapeHtml(command) + "</b><br>" + output;
   txtHistory->setText(txtHistory->text() + str);
   edtCmdLine->setText("");
 

src/app/qgspythondialog.h

@@ -30,6 +30,8 @@ class QgsPythonDialog : public QDialog, private Ui::QgsPythonDialog
 
     ~QgsPythonDialog();
 
+    QString escapeHtml(QString text);
+
   public slots:
 
     void on_edtCmdLine_returnPressed();