[1.1.X] Fixed security issue in AdminFileWidget. Release and disclosure forthcoming.

        output = []

        if value and hasattr(value, "url"):

            output.append('%s <a target="_blank" href="%s">%s</a> <br />%s ' % \

                (_('Currently:'), value.url, value, _('Change:')))

                (_('Currently:'), escape(value.url), escape(value), _('Change:')))

        output.append(super(AdminFileWidget, self).render(name, value, attrs))

        return mark_safe(u''.join(output))

            post_data)

        self.assertContains(response,

            'Select a valid choice. That choice is not one of the available choices.')

class AdminFileWidgetTest(DjangoTestCase):

    def test_render_escapes_html(self):

        class StrangeFieldFile(object):

            url = "something?chapter=1&sect=2&copy=3&lang=en"

            def __unicode__(self):

                return u'''something<div onclick="alert('oops')">.jpg'''

        widget = widgets.AdminFileWidget()

        field = StrangeFieldFile()

        output = widget.render('myfile', field)

        self.assertFalse(field.url in output)

        self.assertTrue(u'href="something?chapter=1&sect=2&copy=3&lang=en"' in output)

        self.assertFalse(unicode(field) in output)

        self.assertTrue(u'something<div onclick="alert('oops')">.jpg' in output)