InlineMultiCheckboxWidget renders unescaped items

[William Grant]

InlineMultiCheckboxWidget does this:

        <ul tal:condition="items">
              <li tal:condition="view/linkify_items"
                  tal:repeat="item items"
                  tal:content="structure item/fmt:link"/>
              <li tal:condition="not:view/linkify_items"
                  tal:repeat="item items"
                  tal:content="structure item"/>
        </ul>

While it's reasonable to expect fmt:link to be safe without escaping, it's not a sensible default to not escape items when linkify_items is false.

No current callsites are affected, but it's going to trip somebody over eventually.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r12793 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/12793>.