naughty: Don't interpret markup in titles

Since only the body text of a notification may contain markup,
by combining the two together and calling set_markup(), the
title would also get interpreted as if it had markup.
This could be seen with:
$ notify-send "Title & text" "<i>body text</i>"

The unescaped & would get interpreted as broken markup and so
naughty would fall back to escaping everything which would make
the "<i>" tags be shown rather than interpreted.

So, the title must always be escaped so that it is not interpreted
as markup.

Signed-off-by: Ross Lagerwall <rosslagerwall@gmail.com>
Signed-off-by: Uli Schlachter <psychon@znc.in>

lib/naughty.lua.in

@@ -303,6 +303,8 @@ function naughty.notify(args)
     local margin = args.margin or preset.margin
     local border_width = args.border_width or preset.border_width
     local position = args.position or preset.position
+    local escape_pattern = "[<>&]"
+    local escape_subs = { ['<'] = "&lt;", ['>'] = "&gt;", ['&'] = "&amp;" }
 
     -- beautiful
     local beautiful = bt.get()
@@ -376,17 +378,20 @@ function naughty.notify(args)
     textbox:set_font(font)
 
     local function setMarkup(pattern, replacements)
-        textbox:set_markup(string.format('<b>%s</b>%s', title:gsub(pattern, replacements), text:gsub(pattern, replacements)))
+        textbox:set_markup(string.format('<b>%s</b>%s', title, text:gsub(pattern, replacements)))
     end
     local function setText()
         textbox:set_text(string.format('%s %s', title, text))
     end
 
-    -- First try to set the text while only interpreting <br>.
+    -- Since the title cannot contain markup, it must be escaped first so that
+    -- it is not interpreted by Pango later.
+    title = title:gsub(escape_pattern, escape_subs)
+    -- Try to set the text while only interpreting <br>.
     -- (Setting a textbox' .text to an invalid pattern throws a lua error)
     if not pcall(setMarkup, "<br.->", "\n") then
         -- That failed, escape everything which might cause an error from pango
-        if not pcall(setMarkup, "[<>&]", { ['<'] = "&lt;", ['>'] = "&gt;", ['&'] = "&amp;" }) then
+        if not pcall(setMarkup, escape_pattern, escape_subs) then
             -- Ok, just ignore all pango markup. If this fails, we got some invalid utf8
             if not pcall(setText) then
                 textbox:set_markup("<i>&lt;Invalid markup or UTF8, cannot display message&gt;</i>")