Missing quoting of <>& in autogenerated forms

[Michael Howitz]

In autogenerated forms <, >, & are not quoted in menus (<select>) when the source for the menu is a vocabulary. So the page isn't valid XML any more.

I put together a little example. To reproduce follow these steps:
- include the demoVendo-package in your zope (using include package in site.zcml)
- create an customer
- inside this customer create an address containing <, >, & in the name
- go to the edit-tag of the customer
- Look at the source of the html-page to see the raw characters
  (Caution: Mozilla shows the characters perfectly quoted (because it shows its dom) but if you fetch the file e.g. using wget it shows up the raw characters.)

[Jim Fulton (jim-zope)]

Changes: submitter email, importance (medium => urgent)

[Jim Fulton (jim-zope)]

Changes: classification (issue => bug)

[Stephan Richter (srichter)]

Status: Pending => Resolved

You were right, the displayed values of a vocabulary were not encoded, but the value of the option tag was. 'renderElement()' did the right thing for the 'value' attribute of the 'option' tag. For the contents of the 'option' tag however, it does not excape, which is the correct behavior. I went through the 'itemswidgets.py' file and escaped all 'option' tag content.

I added a test to verify its correct workings.

See revision 26193.