From f240adfc13d48288f7f3518f8f879cf0fd4a7cb1 Mon Sep 17 00:00:00 2001
From: John MacFarlane <jgm@berkeley.edu>
Date: Sat, 12 May 2018 09:31:15 -0700
Subject: EPUB writer: properly escape pagetitle.

Previously we weren't escaping `&` and other XML characters
in the pagetitle, so a title containing a `&` would be invalid.
---
 src/Text/Pandoc/Writers/EPUB.hs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'src/Text/Pandoc/Writers/EPUB.hs')

diff --git a/src/Text/Pandoc/Writers/EPUB.hs b/src/Text/Pandoc/Writers/EPUB.hs
index f1ff8b482..3c6ab69b9 100644
--- a/src/Text/Pandoc/Writers/EPUB.hs
+++ b/src/Text/Pandoc/Writers/EPUB.hs
@@ -74,6 +74,7 @@ import Text.Printf (printf)
 import Text.XML.Light (Attr (..), Element (..), Node (..), QName (..),
                        add_attrs, lookupAttr, node, onlyElems, parseXML,
                        ppElement, showElement, strContent, unode, unqual)
+import Text.Pandoc.XML (escapeStringForXML)
 
 -- A Chapter includes a list of blocks and maybe a section
 -- number offset.  Note, some chapters are unnumbered. The section
@@ -446,7 +447,8 @@ pandocToEPUB version opts doc@(Pandoc meta _) = do
                        cpContent <- lift $ writeHtml
                             opts'{ writerVariables =
                                     ("coverpage","true"):
-                                    ("pagetitle",plainTitle):
+                                    ("pagetitle",
+                                       escapeStringForXML plainTitle):
                                      cssvars True ++ vars }
                             (Pandoc meta [RawBlock (Format "html") $ "<div id=\"cover-image\">\n<img src=\"../media/" ++ coverImage ++ "\" alt=\"cover image\" />\n</div>"])
                        imgContent <- lift $ P.readFileLazy img
@@ -459,7 +461,7 @@ pandocToEPUB version opts doc@(Pandoc meta _) = do
   -- title page
   tpContent <- lift $ writeHtml opts'{
                                   writerVariables = ("titlepage","true"):
-                                  ("pagetitle",plainTitle):
+                                  ("pagetitle", escapeStringForXML plainTitle):
                                   cssvars True ++ vars }
                                (Pandoc meta [])
   tpEntry <- mkEntry "text/title_page.xhtml" tpContent
@@ -754,7 +756,8 @@ pandocToEPUB version opts doc@(Pandoc meta _) = do
                                (writeHtmlStringForEPUB version
                                  opts{ writerTemplate = Nothing
                                      , writerVariables =
-                                       ("pagetitle",plainTitle):
+                                       ("pagetitle",
+                                         escapeStringForXML plainTitle):
                                        writerVariables opts}
                                  (Pandoc nullMeta
                                    [Plain $ walk clean tit])) of
-- 
cgit v1.2.3