rembo10/headphones — pull request #1677 by sandersch (2014-05-26 06:34:54+00:00)
Title: Use built in CGI module to escape title on history page

You are outputting the raw title of a download into an HTML attribute in a few places on the history page. This means that items with special characters like < > " in their title render invalid HTML and the associated onClick handlers don't work correctly. There are probably a lot more places that you need to potentially escape HTML characters before outputting text into the DOM in different parts of the web ui, but this should take care of all the places that use title on the history page.