Name Format strings can have XML in them; now escaped- prevented valid XML from being written

svn: r15691

src/plugins/export/ExportXml.py

@@ -82,7 +82,11 @@ except:
 strip_dict = dict.fromkeys(range(9)+range(12,20))
 
 def escxml(d):
-    return escape(d, { '"' : '"' } )
+    return escape(d, 
+                  {'"' : '"',
+                   '<' : '&lt;',
+                   '>' : '&gt;',
+                   })
 
 #-------------------------------------------------------------------------
 #
@@ -376,7 +380,8 @@ class GrampsXmlWriter(UpdateCallback):
             for number, name,fmt_str,active in self.db.name_formats:
                 self.g.write('%s<format number="%d" name="%s" '
                              'fmt_str="%s" active="%d"/>\n'
-                             % ('    ', number, name, fmt_str, int(active)) )
+                             % ('    ', number, 
+                                escxml(name), escxml(fmt_str), int(active)) )
             self.g.write("  </name-formats>\n")
 
     def fix(self,line):