X-Git-Url: https://git.notmuchmail.org/git?a=blobdiff_plain;f=devel%2Fnotmuch-web%2Fnmweb.py;h=b0d4d5cd49dd461924e37be80fc196a47fc9edd4;hb=32bef335658763b5e9d887db3ac22bb3c1b76d9e;hp=928e486320f6880c9b41c42b108b67e5874b0135;hpb=3a311ed5ecf3c685cf274c355ac65e21f934fa83;p=notmuch

diff --git a/devel/notmuch-web/nmweb.py b/devel/notmuch-web/nmweb.py
index 928e4863..b0d4d5cd 100755
--- a/devel/notmuch-web/nmweb.py
+++ b/devel/notmuch-web/nmweb.py
@@ -125,13 +125,13 @@ def mailto_addrs(msg,header_name):
     return ''
 
   frm = email.utils.getaddresses([hdr])
-  return ','.join(['<a href="mailto:%s">%s</a> ' % ((l, p) if p else (l, l)) for (p, l) in frm])
+  return ', '.join(['<a href="mailto:%s">%s</a>' % ((l, p) if p else (l, l)) for (p, l) in frm])
 env.globals['mailto_addrs'] = mailto_addrs
 
 def link_msg(msg):
   lnk = quote_plus(msg.messageid.encode('utf8'))
   try:
-    subj = msg.header('Subject')
+    subj = html.escape(msg.header('Subject'))
   except LookupError:
     subj = ""
   out = '<a href="%s/show/%s">%s</a>' % (prefix, lnk, subj)