Escape &, < and > when removing CDATA.

frontend/ui/opdsparser.lua

@@ -80,7 +80,9 @@ function OPDSParser:parse(text)
     text = text:gsub("<br>", "<br />")
     text = text:gsub("<br/>", "<br />")
     -- some OPDS catalogs wrap text in a CDATA section, remove it as it causes parsing problems
-    text = text:gsub("<!%[CDATA%[(.-)%]%]>","%1")
+    text = text:gsub("<!%[CDATA%[(.-)%]%]>", function (s)
+        return s:gsub( "%p", {["&"] = "&amp;", ["<"] = "&lt;", [">"] = "&gt;" } )
+    end )
     local xlex = luxl.new(text, #text)
     return self:createFlatXTable(xlex)
 end

frontend/ui/widget/opdsbrowser.lua

@@ -269,7 +269,7 @@ function OPDSBrowser:fetchFeed(item_url, username, password)
     request['url'] = item_url
     request['method'] = 'GET'
     request['sink'] = ltn12.sink.table(sink)
-    request['headers'] = { Authorization = "Basic " .. mime.b64(auth), ["Host"] = hostname, },
+    request['headers'] = { Authorization = "Basic " .. mime.b64(auth), ["Host"] = hostname, }
     logger.info("request", request)
     http.TIMEOUT, https.TIMEOUT = 10, 10
     local httpRequest = parsed.scheme == 'http' and http.request or https.request