2 files changed, 4 insertions, 2 deletions
diff --git a/addons/website/models/ir_qweb.py b/addons/website/models/ir_qweb.py
index 0e1fe2beb89..6c466355d07 100644
--- a/addons/website/models/ir_qweb.py
+++ b/addons/website/models/ir_qweb.py
@@ -25,6 +25,7 @@ import openerp.modules
 import openerp
 from openerp.osv import orm, fields
 from openerp.tools import ustr, DEFAULT_SERVER_DATE_FORMAT, DEFAULT_SERVER_DATETIME_FORMAT
+from openerp.tools import html_escape as escape
 from openerp.addons.web.http import request
 from openerp.addons.base.ir import ir_qweb
 
@@ -276,7 +277,7 @@ class Image(orm.AbstractModel):
                 url_params[options_key] = options[options_key]
 
         return ir_qweb.HTMLSafe('<img class="%s" src="/website/image?%s"/>' % (
-            ' '.join(itertools.imap(werkzeug.utils.escape, classes)),
+            ' '.join(itertools.imap(escape, classes)),
             werkzeug.urls.url_encode(url_params)
         ))
 
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index db02dcce51e..4cda81c7448 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -27,6 +27,7 @@ except ImportError:
 
 import openerp
 from openerp.osv import orm, osv, fields
+from openerp.tools import html_escape as escape
 from openerp.tools.safe_eval import safe_eval
 from openerp.addons.web.http import request
 
@@ -710,7 +711,7 @@ class ir_attachment(osv.osv):
         for attachment in self.browse(cr, uid, ids, context=context):
             # in-document URLs are html-escaped, a straight search will not
             # find them
-            url = werkzeug.utils.escape(attachment.website_url)
+            url = escape(attachment.website_url)
             ids = Views.search(cr, uid, ["|", ('arch', 'like', '"%s"' % url), ('arch', 'like', "'%s'" % url)], context=context)
 
             if ids: