Escape HTML in JSON of contacts module

UI/Contacts/UIxContactView.m

@@ -29,6 +29,7 @@
 #import <NGCards/CardElement.h>
 #import <NGCards/NSArray+NGCards.h>
 #import <NGExtensions/NSString+Ext.h>
+#import <NGExtensions/NSString+misc.h>
 
 #import <SOGo/NSCalendarDate+SOGo.h>
 #import <SOGo/SOGoDateFormatter.h>
@@ -71,7 +72,7 @@
   NSMutableString *cardString;
 
   cardString = [NSMutableString stringWithCapacity: 80];
-  value = [value stringByReplacingString: @"\r" withString: @""];
+  value = [[value stringByReplacingString: @"\r" withString: @""] stringByEscapingHTMLString];
   if ([value length] > 0)
     {
       if ([url length] > 0)

UI/Contacts/UIxContactsListActions.m

@@ -127,11 +127,32 @@
 - (id <WOActionResults>) contactsListAction
 {
   id <WOActionResults> result;
+  id currentInfo;
   NSArray *contactsList;
+  NSEnumerator *contactsListEnumerator, *keysEnumerator;
+  NSMutableArray *newContactsList;
+  NSMutableDictionary *currentContactDictionary;
+  NSString *key;
 
   contactsList = [self contactInfos];
+  contactsListEnumerator = [contactsList objectEnumerator];
+  newContactsList = [NSMutableArray arrayWithCapacity: [contactsList count]];
+
+  // Escape HTML
+  while ((currentContactDictionary = [contactsListEnumerator nextObject]))
+    {
+      keysEnumerator = [currentContactDictionary keyEnumerator];
+      while ((key = [keysEnumerator nextObject]))
+        {
+          currentInfo = [currentContactDictionary objectForKey: key];
+          if ([currentInfo respondsToSelector: @selector (stringByEscapingHTMLString)])
+            [currentContactDictionary setObject: [currentInfo stringByEscapingHTMLString] forKey: key];
+        }
+      [newContactsList addObject: currentContactDictionary];
+    }
+
   result = [self responseWithStatus: 200
-			  andString: [contactsList jsonRepresentation]];
+			  andString: [newContactsList jsonRepresentation]];
 
   return result;
 }