Merge remote-tracking branch 'upstream/master'

beetsplug/metasync/amarok.py

@@ -21,7 +21,7 @@ from __future__ import division, absolute_import, print_function
 from os.path import basename
 from datetime import datetime
 from time import mktime
-from xml.sax.saxutils import escape
+from xml.sax.saxutils import quoteattr
 
 from beets.util import displayable_path
 from beets.dbcore import types
@@ -51,7 +51,7 @@ class Amarok(MetaSource):
 
     queryXML = u'<query version="1.0"> \
                     <filters> \
-                        <and><include field="filename" value="%s" /></and> \
+                        <and><include field="filename" value=%s /></and> \
                     </filters> \
                 </query>'
 
@@ -71,7 +71,9 @@ class Amarok(MetaSource):
         # for the patch relative to the mount point. But the full path is part
         # of the result set. So query for the filename and then try to match
         # the correct item from the results we get back
-        results = self.collection.Query(self.queryXML % escape(basename(path)))
+        results = self.collection.Query(
+            self.queryXML % quoteattr(basename(path))
+        )
         for result in results:
             if result['xesam:url'] != path:
                 continue

docs/changelog.rst

@@ -30,6 +30,8 @@ Fixes:
   :bug:`2583`
 * :doc:`/plugins/web`: Fix a crash on Windows under Python 2 when serving
   non-ASCII filenames. Thanks to :user:`robot3498712`. :bug:`2592` :bug:`2593`
+* :doc:`/plugins/metasync`: Fix a crash in the Amarok backend when filenames
+  contain quotes. Thanks to :user:`aranc23`. :bug:`2595` :bug:`2596`
 
 
 1.4.4 (June 10, 2017)