filters: Escape State names when generating selector HTML

States with names containing special characters are not correctly escaped
when generating the select list. Use escape() to fix this.

Signed-off-by: Andrew Donnellan <[email protected]>
(cherry picked from commit b3fa0c4)
Signed-off-by: Daniel Axtens <[email protected]>

Author: ajdlinux

patchwork/filters.py

@@ -254,7 +254,7 @@ def _form(self):
                 selected = ' selected="true"'
 
             out += '<option value="%d" %s>%s</option>' % (
-                state.id, selected, state.name)
+                state.id, selected, escape(state.name))
         out += '</select>'
         return mark_safe(out)