3 files changed, 20 insertions, 4 deletions
diff --git a/docs/tutorials/wiki/authorization.rst b/docs/tutorials/wiki/authorization.rst
index 62b1164e3..93cd0c18e 100644
--- a/docs/tutorials/wiki/authorization.rst
+++ b/docs/tutorials/wiki/authorization.rst
@@ -149,8 +149,8 @@ to the ``@view_config`` decorator for ``add_page()`` and
 ``edit_page()``, for example:
 
 .. code-block:: python
-   :linenos:
-   :emphasize-lines: 3
+    :linenos:
+    :emphasize-lines: 3
 
     @view_config(name='add_page', context='.models.Wiki',
                  renderer='templates/edit.pt',
diff --git a/docs/tutorials/wiki2/authorization.rst b/docs/tutorials/wiki2/authorization.rst
index 1e5d0dcbf..2e35574fd 100644
--- a/docs/tutorials/wiki2/authorization.rst
+++ b/docs/tutorials/wiki2/authorization.rst
@@ -207,6 +207,21 @@ routes:
    :linenos:
    :language: python
 
+.. note:: The preceding lines must be added *before* the following
+   ``view_page`` route definition:
+
+   .. literalinclude:: src/authorization/tutorial/__init__.py
+      :lines: 32
+      :linenos:
+      :language: python
+
+   This is because ``view_page``'s route definition uses a catch-all
+   "replacement marker" ``/{pagename}`` (see :ref:`route_pattern_syntax`)
+   which will catch any route that was not already caught by any
+   route listed above it in ``__init__.py``. Hence, for ``login`` and
+   ``logout`` views to have the opportunity of being matched
+   (or "caught"), they must be above ``/{pagename}``.
+
 Add Login and Logout Views
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/docs/tutorials/wiki2/src/views/tutorial/views.py b/docs/tutorials/wiki2/src/views/tutorial/views.py
index 42ef77b98..b41d4ab40 100644
--- a/docs/tutorials/wiki2/src/views/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/views/tutorial/views.py
@@ -1,3 +1,4 @@
+import cgi
 import re
 from docutils.core import publish_parts
 
@@ -32,10 +33,10 @@ def view_page(request):
         exists = DBSession.query(Page).filter_by(name=word).all()
         if exists:
             view_url = request.route_url('view_page', pagename=word)
-            return '<a href="%s">%s</a>' % (view_url, word)
+            return '<a href="%s">%s</a>' % (view_url, cgi.escape(word))
         else:
             add_url = request.route_url('add_page', pagename=word)
-            return '<a href="%s">%s</a>' % (add_url, word)
+            return '<a href="%s">%s</a>' % (add_url, cgi.escape(word))
 
     content = publish_parts(page.data, writer_name='html')['html_body']
     content = wikiwords.sub(check, content)