Escape all text passed to Palette.primary_text and .secondary_text

sugar.graphics.palette.Palette passes primary_text and secondary_text through
to GTK without escaping it, so we need to make sure it doesn't contain
anything special in user data (activity title, bundle_id, nick name, etc.) or
translations.

Signed-off-by: Sascha Silbe <silbe@activitycentral.com>
Acked-by: Simon Schampijer <simon@laptop.org>

4 files changed, 30 insertions, 18 deletions

diff --git a/extensions/deviceicon/battery.py b/extensions/deviceicon/battery.py
index 4c1ef37..260cb12 100644
--- a/extensions/deviceicon/battery.py
+++ b/extensions/deviceicon/battery.py
@@ -19,6 +19,7 @@ from gettext import gettext as _
 import sys
 
 import gconf
+import glib
 import gobject
 import gtk
 import dbus
@@ -67,7 +68,7 @@ class DeviceView(TrayIcon):
         self.set_palette_invoker(FrameWidgetInvoker(self))
 
         self._model = DeviceModel(battery)
-        self.palette = BatteryPalette(_('My Battery'))
+        self.palette = BatteryPalette(glib.markup_escape_text(_('My Battery')))
         self.palette.set_group_id('frame')
         self._model.connect('updated',
                             self.__battery_status_changed_cb)
@@ -161,7 +162,7 @@ class BatteryPalette(Palette):
 
         self.set_content(progress_widget)
 
-        self.props.secondary_text = secondary_text
+        self.props.secondary_text = glib.markup_escape_text(secondary_text)
         self._status_label.set_text(status_text)
 
 
diff --git a/extensions/deviceicon/network.py b/extensions/deviceicon/network.py
index cf8bd08..789ea13 100644
--- a/extensions/deviceicon/network.py
+++ b/extensions/deviceicon/network.py
@@ -109,11 +109,12 @@ class WirelessPalette(Palette):
         self.menu.append(self._disconnect_item)
 
     def set_connecting(self):
-        self.props.secondary_text = _('Connecting...')
+        label = glib.markup_escape_text(_('Connecting...'))
+        self.props.secondary_text = label
 
     def _set_connected(self, iaddress):
         self.set_content(self._info)
-        self.props.secondary_text = _('Connected')
+        self.props.secondary_text = glib.markup_escape_text(_('Connected'))
         self._set_ip_address(iaddress)
         self._disconnect_item.show()
 
@@ -155,7 +156,8 @@ class WiredPalette(Palette):
     __gtype_name__ = 'SugarWiredPalette'
 
     def __init__(self):
-        Palette.__init__(self, label=_('Wired Network'))
+        label = glib.markup_escape_text(_('Wired Network'))
+        Palette.__init__(self, primary_text=label)
 
         self._speed_label = gtk.Label()
         self._speed_label.props.xalign = 0.0
@@ -180,7 +182,7 @@ class WiredPalette(Palette):
         self._info.show_all()
 
         self.set_content(self._info)
-        self.props.secondary_text = _('Connected')
+        self.props.secondary_text = glib.markup_escape_text(_('Connected'))
 
     def set_connected(self, speed, iaddress):
         self._speed_label.set_text('%s: %d Mb/s' % (_('Speed'), speed))
@@ -208,8 +210,8 @@ class GsmPalette(Palette):
     }
 
     def __init__(self):
-
-        Palette.__init__(self, label=_('Wireless modem'))
+        label = glib.markup_escape_text(_('Wireless modem'))
+        Palette.__init__(self, primary_text=label)
 
         self._current_state = None
         self._failed_connection = False
@@ -276,19 +278,22 @@ class GsmPalette(Palette):
     def _update_label_and_text(self, reason=0):
         if self._current_state == _GSM_STATE_NOT_READY:
             self._toggle_state_item.get_child().set_label('...')
-            self.props.secondary_text = _('Please wait...')
+            label = glib.markup_escape_text(_('Please wait...'))
+            self.props.secondary_text = label
 
         elif self._current_state == _GSM_STATE_DISCONNECTED:
             if not self._failed_connection:
                 self._toggle_state_item.get_child().set_label(_('Connect'))
-            self.props.secondary_text = _('Disconnected')
+            label = glib.markup_escape_text(_('Disconnected'))
+            self.props.secondary_text = label
             icon = Icon(icon_name='dialog-ok', \
                             icon_size=gtk.ICON_SIZE_MENU)
             self._toggle_state_item.set_image(icon)
 
         elif self._current_state == _GSM_STATE_CONNECTING:
             self._toggle_state_item.get_child().set_label(_('Cancel'))
-            self.props.secondary_text = _('Connecting...')
+            label = glib.markup_escape_text(_('Connecting...'))
+            self.props.secondary_text = label
             icon = Icon(icon_name='dialog-cancel', \
                             icon_size=gtk.ICON_SIZE_MENU)
             self._toggle_state_item.set_image(icon)
@@ -338,10 +343,11 @@ class GsmPalette(Palette):
 
     def update_connection_time(self, connection_time=None):
         if connection_time is not None:
-            self.props.secondary_text = _('Connected for %s') % \
-                    connection_time.strftime('%H:%M:%S')
+            formatted_time = connection_time.strftime('%H:%M:%S')
         else:
-            self.props.secondary_text = _('Connected for %s') % '00:00:00'
+            formatted_time = '00:00:00'
+        text = _('Connected for %s') % (formatted_time, )
+        self.props.secondary_text = glib.markup_escape_text(text)
 
     def update_stats(self, in_bytes, out_bytes):
         in_KBytes = in_bytes / 1024
@@ -603,7 +609,8 @@ class OlpcMeshDeviceView(ToolButton):
         self._icon.show()
 
         self.set_palette_invoker(FrameWidgetInvoker(self))
-        self._palette = WirelessPalette(_('Mesh Network'))
+        title = _('Mesh Network')
+        self._palette = WirelessPalette(glib.markup_escape_text(title))
         self._palette.connect('deactivate-connection',
                               self.__deactivate_connection)
         self.set_palette(self._palette)
@@ -646,7 +653,7 @@ class OlpcMeshDeviceView(ToolButton):
 
     def _update_text(self):
         channel = str(self._channel)
-        text = _('Mesh Network %s') % glib.markup_escape_text(channel)
+        text = glib.markup_escape_text(_('Mesh Network %s') % (channel, ))
         self._palette.props.primary_text = text
 
     def _update(self):
diff --git a/extensions/deviceicon/speaker.py b/extensions/deviceicon/speaker.py
index d396bfb..d8b26be 100644
--- a/extensions/deviceicon/speaker.py
+++ b/extensions/deviceicon/speaker.py
@@ -17,6 +17,7 @@
 from gettext import gettext as _
 import gconf
 
+import glib
 import gobject
 import gtk
 
@@ -57,7 +58,8 @@ class DeviceView(TrayIcon):
         self._update_info()
 
     def create_palette(self):
-        palette = SpeakerPalette(_('My Speakers'), model=self._model)
+        label = glib.markup_escape_text(_('My Speakers'))
+        palette = SpeakerPalette(label, model=self._model)
         palette.set_group_id('frame')
         return palette
 
diff --git a/extensions/deviceicon/touchpad.py b/extensions/deviceicon/touchpad.py
index b3b34f5..6773afc 100644
--- a/extensions/deviceicon/touchpad.py
+++ b/extensions/deviceicon/touchpad.py
@@ -20,6 +20,7 @@ import os
 
 import gtk
 import gconf
+import glib
 
 import logging
 
@@ -64,7 +65,8 @@ class DeviceView(TrayIcon):
     def create_palette(self):
         """ Create a palette for this icon; called by the Sugar framework
         when a palette needs to be displayed. """
-        self.palette = ResourcePalette(_('My touchpad'), self.icon)
+        label = glib.markup_escape_text(_('My touchpad'))
+        self.palette = ResourcePalette(label, self.icon)
         self.palette.set_group_id('frame')
         return self.palette