From 332ecdcaeac92daa61db3d0af041883a0d8259e6 Mon Sep 17 00:00:00 2001
From: Lonami <lonami@noreply.togrand.xyz>
Date: Tue, 3 Sep 2019 21:50:39 +0200
Subject: [PATCH] Escape display name in who

---
 stdplugins/who.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/stdplugins/who.py b/stdplugins/who.py
index cea0cd9..897ec1c 100644
--- a/stdplugins/who.py
+++ b/stdplugins/who.py
@@ -1,6 +1,7 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+import html
 
 from telethon import events
 from telethon import utils
@@ -20,7 +21,7 @@ async def _(event):
         else:
             who = await msg.get_sender()
 
-    who_string = utils.get_display_name(who)
+    who_string = html.escape(utils.get_display_name(who))
     if isinstance(who, (types.User, types.Channel)) and who.username:
         who_string += f" <i>(@{who.username})</i>"
     who_string += f", <a href='tg://user?id={who.id}'>#{who.id}</a>"