[gnome-software] Escape markup before showing modal dialogs

[Richard Hughes <rhughes src gnome org>]

commit b08d3ffecce5ea98972980b713f73b1129d6110f
Author: Richard Hughes <richard hughsie com>
Date:   Tue Feb 23 11:50:10 2016 +0000

    Escape markup before showing modal dialogs
    
    Resolves: https://bugzilla.gnome.org/show_bug.cgi?id=749996

 src/gs-page.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)
---
diff --git a/src/gs-page.c b/src/gs-page.c
index 96d0196..bf79568 100644
--- a/src/gs-page.c
+++ b/src/gs-page.c
@@ -171,6 +171,7 @@ gs_page_update_app (GsPage *page, GsApp *app)
        GtkResponseType response;
        GtkWidget *dialog;
        AsScreenshot *ss;
+       g_autofree gchar *escaped = NULL;
 
        /* non-firmware applications do not have to be prepared */
        if (gs_app_get_id_kind (app) != AS_ID_KIND_FIRMWARE) {
@@ -198,8 +199,9 @@ gs_page_update_app (GsPage *page, GsApp *app)
                                          * '%s' is an application summary, e.g. 'GNOME Clocks' */
                                         _("Prepare %s"),
                                         gs_app_get_name (app));
+       escaped = g_markup_escape_text (as_screenshot_get_caption (ss, NULL), -1);
        gtk_message_dialog_format_secondary_markup (GTK_MESSAGE_DIALOG (dialog),
-                                                   "%s", as_screenshot_get_caption (ss, NULL));
+                                                   "%s", escaped);
        /* TRANSLATORS: this is button text to update the firware */
        gtk_dialog_add_button (GTK_DIALOG (dialog), _("Install"), GTK_RESPONSE_OK);
        response = gtk_dialog_run (GTK_DIALOG (dialog));
@@ -214,6 +216,7 @@ gs_page_remove_app (GsPage *page, GsApp *app)
        GsPagePrivate *priv = gs_page_get_instance_private (page);
        GtkResponseType response;
        GtkWidget *dialog;
+       g_autofree gchar *escaped = NULL;
 
        dialog = gtk_message_dialog_new (gs_shell_get_window (priv->shell),
                                         GTK_DIALOG_MODAL,
@@ -223,10 +226,11 @@ gs_page_remove_app (GsPage *page, GsApp *app)
                                          * '%s' is an application summary, e.g. 'GNOME Clocks' */
                                         _("Are you sure you want to remove %s?"),
                                         gs_app_get_name (app));
+       escaped = g_markup_escape_text (gs_app_get_name (app), -1);
        gtk_message_dialog_format_secondary_markup (GTK_MESSAGE_DIALOG (dialog),
                                                    /* TRANSLATORS: longer dialog text */
                                                     _("%s will be removed, and you will have to install it 
to use it again."),
-                                                    gs_app_get_name (app));
+                                                    escaped);
        /* TRANSLATORS: this is button text to remove the application */
        gtk_dialog_add_button (GTK_DIALOG (dialog), _("Remove"), GTK_RESPONSE_OK);
        if (gs_app_get_state (app) == AS_APP_STATE_QUEUED_FOR_INSTALL)