fixed issue 1808:HTML Injection on Terminal(shell) online

applications/admin/controllers/shell.py

@@ -3,6 +3,7 @@ import cStringIO
 import gluon.contrib.shell
 import code
 import thread
+import cgi
 from gluon.shell import env
 
 if DEMO_MODE or MULTI_USER_MODE:
@@ -40,7 +41,7 @@ def callback():
     k = len(session['commands:' + app]) - 1
     #output = PRE(output)
     #return TABLE(TR('In[%i]:'%k,PRE(command)),TR('Out[%i]:'%k,output))
-    return 'In [%i] : %s%s\n' % (k + 1, command, output)
+    return cgi.escape('In [%i] : %s%s\n' % (k + 1, command, output))
 
 
 def reset():