mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-28 16:16:12 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #6160, #9111 -- Consistently apply conditional_escape to form errors and labels when outputing them as HTML.

Browse Source 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9365 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Karen Tracey
2008-11-06 19:49:24 +00:00
parent 04354e1afc
commit bcd63cbfb0
5 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
django/forms/forms.py
View File

@@ -5,7 +5,7 @@ Form classes
from copy import deepcopy
from django.utils.datastructures import SortedDict
from django.utils.html import escape
from django.utils.html import conditional_escape
from django.utils.encoding import StrAndUnicode, smart_unicode, force_unicode
from django.utils.safestring import mark_safe
@@ -140,7 +140,7 @@ class BaseForm(StrAndUnicode):
output, hidden_fields = [], []
for name, field in self.fields.items():
bf = BoundField(self, field, name)
bf_errors = self.error_class([escape(error) for error in bf.errors]) # Escape and cache in local variable.
bf_errors = self.error_class([conditional_escape(error) for error in bf.errors]) # Escape and cache in local variable.
if bf.is_hidden:
if bf_errors:
top_errors.extend([u'(Hidden field %s) %s' % (name, force_unicode(e)) for e in bf_errors])
@@ -149,7 +149,7 @@ class BaseForm(StrAndUnicode):
if errors_on_separate_row and bf_errors:
output.append(error_row % force_unicode(bf_errors))
if bf.label:
label = escape(force_unicode(bf.label))
label = conditional_escape(force_unicode(bf.label))
# Only add the suffix if the label does not end in
# punctuation.
if self.label_suffix:
@@ -395,7 +395,7 @@ class BoundField(StrAndUnicode):
If attrs are given, they're used as HTML attributes on the <label> tag.
"""
contents = contents or escape(self.label)
contents = contents or conditional_escape(self.label)
widget = self.field.widget
id_ = widget.attrs.get('id') or self.auto_id
if id_:

2
django/forms/util.py
View File

@@ -39,7 +39,7 @@ class ErrorList(list, StrAndUnicode):
def as_ul(self):
if not self: return u''
return mark_safe(u'<ul class="errorlist">%s</ul>'
% ''.join([u'<li>%s</li>' % force_unicode(e) for e in self]))
% ''.join([u'<li>%s</li>' % conditional_escape(force_unicode(e)) for e in self]))
def as_text(self):
if not self: return u''