Dynamic variables in reports should be escaped

[nil4]

The code in Report.py — sql_sub_vars only does a simple string substitution on the dynamic variables, with no escaping of dangerous characters (including backslash). I see two problems with this approach:

• It opens the door for SQL injection attacks on the sqlite database of trac repositories.
• It makes it impossible to write reports that use the $USER variable when users are authenticated in a domain, since the backslash is interpreted as a string escape modifier.

For example, the following code fails with an error, when the logged user is domain\username:

SELECT * FROM ticket WHERE owner = '$USER'

[nil4]

Actually, I just saw the values of dynamic variables are restricted by regexes, so I guess they're safe from SQL injection attacks.

Still, there's no way I can use to create reports for users authenticated in a Windows domain.

[Matthew Good]

This was addressed in #2536