--- a/roundup/cgi/client.py	Tue Jun 29 07:55:34 2010 +0000
+++ b/roundup/cgi/client.py	Thu Jul 01 01:41:54 2010 +0000
@@ -1069,9 +1069,9 @@
                 result = result.replace('</body>', s)
             return result
         except templating.NoTemplate, message:
-            return '<strong>%s</strong>'%message
+            return '<strong>%s</strong>'%cgi.escape(str(message))
         except templating.Unauthorised, message:
-            raise Unauthorised(str(message))
+            raise Unauthorised(cgi.escape(str(message)))
         except:
             # everything else
             if self.instance.config.WEB_DEBUG: