- Don't escape properties stored as XML (ie: having a
        __xml_attrs__ metadata set by PROPPATCH) when building a
        PROPFIND response.

      - If a PROPPATCH element value contains only a CDATA section,
        store the CDATA contents only.

doc/CHANGES.txt

@@ -57,6 +57,13 @@ Zope Changes
 
       - Escape/unescape " and '
 
+      - Don't escape properties stored as XML (ie: having a
+        __xml_attrs__ metadata set by PROPPATCH) when building a
+        PROPFIND response.
+
+      - If a PROPPATCH element value contains only a CDATA section,
+        store the CDATA contents only.
+
   Zope 2.8a1
 
 

lib/python/OFS/PropertySheets.py

@@ -324,12 +324,12 @@ class PropertySheet(Traversable, Persistent, Implicit):
             # check for xml property
             attrs=item.get('meta', {}).get('__xml_attrs__', None)
             if attrs is not None:
+                # It's a xml property. Don't escape value.
                 attrs=map(lambda n: ' %s="%s"' % n, attrs.items())
                 attrs=''.join(attrs)
             else:
-                # Quote non-xml items here?
+                # It's a non-xml property. Escape value.
                 attrs=''
-
                 if not hasattr(self,"dav__"+name):
                     value = xml_escape(value)
             prop='  <n:%s%s>%s</n:%s>' % (name, attrs, value, name)
@@ -375,10 +375,11 @@ class PropertySheet(Traversable, Persistent, Implicit):
             # allow for xml properties
             attrs=item.get('meta', {}).get('__xml_attrs__', None)
             if attrs is not None:
+                # It's a xml property. Don't escape value.
                 attrs=map(lambda n: ' %s="%s"' % n, attrs.items())
                 attrs=''.join(attrs)
             else:
-                # quote non-xml items here?
+                # It's a non-xml property. Escape value.
                 attrs=''
                 if not hasattr(self, 'dav__%s' % name):
                     value = xml_escape(value)

lib/python/webdav/xmltools.py

@@ -34,6 +34,7 @@ TODO:
 
 """
 
+from StringIO import StringIO
 from xml.dom import minidom
 from xml.sax.saxutils import escape as _escape, unescape as _unescape
 
@@ -72,7 +73,7 @@ class Node:
     node = None
 
     def __init__(self, node):
-        self.node=node
+        self.node = node
 
     def elements(self, name=None, ns=None):
         nodes = []
@@ -112,6 +113,9 @@ class Node:
         #       but the :n isnt part of the attribute name .. gash!
 
         attr = name.split(':')[0]
+        if (self.node.hasAttributes() and
+            self.node.attributes.has_key(attr)):
+            # Only remove attributes if they exist
             return self.node.removeAttribute(attr)
 
     def remap(self, dict, n=0, top=1):
@@ -136,16 +140,23 @@ class Element(Node):
 
     def toxml(self):
         # When dealing with Elements, we only want the Element's content.
-        result = u''
+        writer = StringIO(u'')
         for n in self.node.childNodes:
+            if n.nodeType == n.CDATA_SECTION_NODE:
+                # CDATA sections should not be unescaped.
+                writer.write(n.data)
+            elif n.nodeType == n.ELEMENT_NODE:
+                writer.write(n.toxml())
+            else:
+                # TEXT_NODE and what else?
                 value = n.toxml()
-            # Use unescape possibly escaped values.  We do this
+                # Unescape possibly escaped values.  We do this
                 # because the value is *always* escaped in it's XML
                 # representation, and if we store it escaped it will come
                 # out *double escaped* when doing a PROPFIND.
                 value = unescape(value, entities=unescape_entities)
-            result += value
-        return result
+                writer.write(value)
+        return writer.getvalue()
 
 class XmlParser:
     """ Simple wrapper around minidom to support the required