Fixing bug 482 in a way we escape all passed from URL parameters.

[osqa.git] / forum / views / readers.py

diff --git a/forum/views/readers.py b/forum/views/readers.py
index 8e641bf7a1fbc59a44e109c1632284b9a9d44329..fbc0ed19233f8dbdc42f1a53d6ec15c0a3c4c510 100644 (file)
--- a/forum/views/readers.py
+++ b/forum/views/readers.py
@@ -167,7 +167,7 @@ def question_list(request, initial,
         if req_params:
             req_params = '&' + req_params
 
-        feed_url = mark_safe(request.path + "?type=rss" + req_params)
+        feed_url = mark_safe(escape(request.path + "?type=rss" + req_params))
 
     return pagination.paginated(request, ('questions', paginator_context or QuestionListPaginatorContext()), {
     "questions" : questions.distinct(),