[views] fix URLs by using xml_escape

views.py

@@ -173,6 +173,6 @@
             current_page = int(url_params.get('page', 1))
             url_params['page'] = current_page - 1
             if current_page - 1 >= 1:
-                ul(t.li(t.a('<' * 3,
-                            href=self._cw.build_url(**url_params))))
+                ul(t.li(t.a(u' < ' * 3,
+                            href=xml_escape(self._cw.build_url(**url_params)))))
             else:
@@ -178,5 +178,5 @@
             else:
-                ul(t.li(t.a('<' * 3)))
+                ul(t.li(t.a(u' < ' * 3)))
             total_pages = (response.hits.total / 10) + 2
             page_padding = 3
 
@@ -186,9 +186,9 @@
                                       current_page - page_padding)):
                     self.page_number(url_params, page, current_page, ul)
                 if current_page > (page_padding * 2) + 1:
-                    ul(t.li(t.a("·" * 3)))
+                    ul(t.li(t.a(u" · " * 3)))
             for page in range(max(1, current_page - page_padding),
                               min(current_page + page_padding, total_pages)):
                 self.page_number(url_params, page, current_page, ul)
             if current_page < total_pages - page_padding:
                 if current_page < total_pages - page_padding * 2:
@@ -190,9 +190,9 @@
             for page in range(max(1, current_page - page_padding),
                               min(current_page + page_padding, total_pages)):
                 self.page_number(url_params, page, current_page, ul)
             if current_page < total_pages - page_padding:
                 if current_page < total_pages - page_padding * 2:
-                    ul(t.li(t.a("&middot" * 3)))
+                    ul(t.li(t.a(u" &middot; " * 3)))
                 for page in range(max(current_page + page_padding,
                                       total_pages - page_padding),
                                   total_pages):
@@ -200,5 +200,5 @@
 
             url_params['page'] = current_page + 1
             if current_page + 1 >= (total_pages):
-                ul(t.li(t.a('&gt;' * 3)))
+                ul(t.li(t.a(u' &gt; ' * 3)))
             else:
@@ -204,6 +204,6 @@
             else:
-                ul(t.li(t.a('&gt;' * 3,
-                            href=self._cw.build_url(**url_params))))
+                ul(t.li(t.a(u' &gt; ' * 3,
+                            href=xml_escape(self._cw.build_url(**url_params)))))
 
     def page_number(self, url_params, page, current_page, ul):
         '''
@@ -213,6 +213,6 @@
         url = self._cw.build_url(**url_params)
         if page == current_page:
             ul(t.li(t.a(t.b(page),
-                        href=url)))
+                        href=xml_escape(url))))
         else:
             ul(t.li(t.a(page,
@@ -217,6 +217,6 @@
         else:
             ul(t.li(t.a(page,
-                        href=url)))
+                        href=xml_escape(url))))
         return url
 
     @property