devel/ipython -- multiple vulnerabilities

Matthias Bussonnier reports:

Summary: Local folder name was used in HTML templates without
escaping, allowing XSS in said pages by carefully crafting folder
name and URL to access it.
URI with issues:

GET /tree/**

Benjamin RK reports:

Vulnerability: A maliciously forged file opened for editing can
execute javascript, specifically by being redirected to /files/ due
to a failure to treat the file as plain text.
URI with issues:

GET /edit/**