Commit 1f2abf78 authored by Moritz Sichert's avatar Moritz Sichert Committed by Tim Graham
Browse files

Fixed #24469 -- Refined escaping of Django's form elements in non-Django templates.

parent dc5b01ad

AUTHORS

+1 −0
Original line number Diff line number Diff line
@@ -498,6 +498,7 @@ answer newbie questions, and generally made Django that much better: 
    mitakummaa@gmail.com

    mmarshall

    Moayad Mardini <moayad.m@gmail.com>

    Moritz Sichert <moritz.sichert@googlemail.com>

    Morten Bagai <m@bagai.com>

    msaelices <msaelices@gmail.com>

    msundstr

django/contrib/gis/maps/google/overlays.py

+5 −3
Original line number Diff line number Diff line
@@ -6,9 +6,10 @@ from django.contrib.gis.geos import ( 
from django.utils import six

from django.utils.encoding import python_2_unicode_compatible

from django.utils.functional import total_ordering

from django.utils.safestring import mark_safe

from django.utils.html import html_safe





@html_safe

@python_2_unicode_compatible

class GEvent(object):

    """
@@ -56,9 +57,10 @@ class GEvent(object): 


    def __str__(self):

        "Returns the parameter part of a GEvent."

        return mark_safe('"%s", %s' % (self.event, self.action))

        return '"%s", %s' % (self.event, self.action)





@html_safe

@python_2_unicode_compatible

class GOverlayBase(object):

    def __init__(self):
@@ -74,7 +76,7 @@ class GOverlayBase(object): 


    def __str__(self):

        "The string representation is the JavaScript API call."

        return mark_safe('%s(%s)' % (self.__class__.__name__, self.js_params))

        return '%s(%s)' % (self.__class__.__name__, self.js_params)





class GPolygon(GOverlayBase):

django/forms/forms.py

+3 −7
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ from django.utils import six 
from django.utils.encoding import (

    force_text, python_2_unicode_compatible, smart_text,

)

from django.utils.html import conditional_escape, format_html

from django.utils.html import conditional_escape, format_html, html_safe

from django.utils.safestring import mark_safe

from django.utils.translation import ugettext as _
@@ -67,6 +67,7 @@ class DeclarativeFieldsMetaclass(MediaDefiningClass): 
        return new_class





@html_safe

@python_2_unicode_compatible

class BaseForm(object):

    # This is the main implementation of all the Form logic. Note that this
@@ -122,9 +123,6 @@ class BaseForm(object): 
        fields.update(self.fields)  # add remaining fields in original order

        self.fields = fields



    def __html__(self):

        return force_text(self)



    def __str__(self):

        return self.as_table()
@@ -504,6 +502,7 @@ class Form(six.with_metaclass(DeclarativeFieldsMetaclass, BaseForm)): 
    # BaseForm itself has no way of designating self.fields.





@html_safe

@python_2_unicode_compatible

class BoundField(object):

    "A Field plus data"
@@ -521,9 +520,6 @@ class BoundField(object): 
        self.help_text = field.help_text or ''

        self._initial_value = UNSET



    def __html__(self):

        return force_text(self)



    def __str__(self):

        """Renders this field as an HTML widget."""

        if self.field.show_hidden_initial:

django/forms/formsets.py

+2 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ from django.forms.widgets import HiddenInput 
from django.utils import six

from django.utils.encoding import python_2_unicode_compatible

from django.utils.functional import cached_property

from django.utils.html import html_safe

from django.utils.safestring import mark_safe

from django.utils.six.moves import range

from django.utils.translation import ugettext as _, ungettext
@@ -46,6 +47,7 @@ class ManagementForm(Form): 
        super(ManagementForm, self).__init__(*args, **kwargs)





@html_safe

@python_2_unicode_compatible

class BaseFormSet(object):

    """

django/forms/utils.py

+3 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ from django.conf import settings 
from django.core.exceptions import ValidationError  # backwards compatibility

from django.utils import six, timezone

from django.utils.encoding import force_text, python_2_unicode_compatible

from django.utils.html import escape, format_html, format_html_join

from django.utils.html import escape, format_html, format_html_join, html_safe

from django.utils.translation import ugettext_lazy as _



try:
@@ -40,6 +40,7 @@ def flatatt(attrs): 
    )





@html_safe

@python_2_unicode_compatible

class ErrorDict(dict):

    """
@@ -72,6 +73,7 @@ class ErrorDict(dict): 
        return self.as_ul()





@html_safe

@python_2_unicode_compatible

class ErrorList(UserList, list):

    """