fixed issue 1808:HTML Injection on Terminal(shell) online

VERSION

@@ -1 +1 @@
-Version 2.8.2-stable+timestamp.2013.12.07.10.19.34
+Version 2.8.2-stable+timestamp.2013.12.07.18.35.39

applications/admin/controllers/shell.py

@@ -3,6 +3,7 @@ import cStringIO
 import gluon.contrib.shell
 import code
 import thread
+import cgi
 from gluon.shell import env
 
 if DEMO_MODE or MULTI_USER_MODE:
@@ -40,7 +41,7 @@ def callback():
     k = len(session['commands:' + app]) - 1
     #output = PRE(output)
     #return TABLE(TR('In[%i]:'%k,PRE(command)),TR('Out[%i]:'%k,output))
-    return 'In [%i] : %s%s\n' % (k + 1, command, output)
+    return cgi.escape('In [%i] : %s%s\n' % (k + 1, command, output))
 
 
 def reset():

applications/admin/views/shell/index.html

@@ -4,7 +4,8 @@
 <div id="wrapper">
   <div class="row-fluid">
     <div class="output-wrapper span8">
-			<textarea id="output" readonly="readonly">web2py Shell {{=request.env.web2py_version}}</textarea>
+      <textarea id="output" readonly="readonly">web2py Shell {{=request.env.web2py_version}}
+</textarea>
     </div>
   </div>