X-Git-Url: https://git.cworth.org/git?p=notmuch;a=blobdiff_plain;f=devel%2Fnotmuch-web%2Fnmweb.py;h=7b555c62b6eeadd3deadaa2cec5584fa4edf535f;hp=928e486320f6880c9b41c42b108b67e5874b0135;hb=48d6b31485dfd3110b82fd8829063297284c78c0;hpb=bf8aa34324cc91a530b0b12f833f106c939f7d84

diff --git a/devel/notmuch-web/nmweb.py b/devel/notmuch-web/nmweb.py
index 928e4863..7b555c62 100755
--- a/devel/notmuch-web/nmweb.py
+++ b/devel/notmuch-web/nmweb.py
@@ -131,7 +131,7 @@ env.globals['mailto_addrs'] = mailto_addrs
 def link_msg(msg):
   lnk = quote_plus(msg.messageid.encode('utf8'))
   try:
-    subj = msg.header('Subject')
+    subj = html.escape(msg.header('Subject'))
   except LookupError:
     subj = ""
   out = '<a href="%s/show/%s">%s</a>' % (prefix, lnk, subj)