Encode redirect response URLs
Fix
@@ -271,7 +271,7 @@ class HTTPRedirect(CherryPyException):
307: 'This resource has moved temporarily to ',
}[status]
msg += '<a href=%s>%s</a>.'
- msgs = [msg % (saxutils.quoteattr(u), u) for u in self.urls]
+ msgs = [msg % (saxutils.quoteattr(u), escape_html(u)) for u in self.urls]
response.body = ntob('<br />\n'.join(msgs), 'utf-8')
# Previous code may have set C-L, so we have to reset it
# (allow finalize to set it).
