Commit 44a05a8a authored by Moritz Sichert's avatar Moritz Sichert Committed by Tim Graham
Browse files

[1.8.x] Fixed #24469 -- Refined escaping of Django's form elements in non-Django templates. 

Backport of 1f2abf78 from master
parent 6a2f46f2

AUTHORS

+1 −0
Original line number Diff line number Diff line
@@ -494,6 +494,7 @@ answer newbie questions, and generally made Django that much better: 
    mitakummaa@gmail.com

    mmarshall

    Moayad Mardini <moayad.m@gmail.com>

    Moritz Sichert <moritz.sichert@googlemail.com>

    Morten Bagai <m@bagai.com>

    msaelices <msaelices@gmail.com>

    msundstr

django/contrib/gis/maps/google/overlays.py

+5 −3
Original line number Diff line number Diff line
@@ -6,9 +6,10 @@ from django.contrib.gis.geos import ( 
from django.utils import six

from django.utils.encoding import python_2_unicode_compatible

from django.utils.functional import total_ordering

from django.utils.safestring import mark_safe

from django.utils.html import html_safe





@html_safe

@python_2_unicode_compatible

class GEvent(object):

    """
@@ -56,9 +57,10 @@ class GEvent(object): 


    def __str__(self):

        "Returns the parameter part of a GEvent."

        return mark_safe('"%s", %s' % (self.event, self.action))

        return '"%s", %s' % (self.event, self.action)





@html_safe

@python_2_unicode_compatible

class GOverlayBase(object):

    def __init__(self):
@@ -74,7 +76,7 @@ class GOverlayBase(object): 


    def __str__(self):

        "The string representation is the JavaScript API call."

        return mark_safe('%s(%s)' % (self.__class__.__name__, self.js_params))

        return '%s(%s)' % (self.__class__.__name__, self.js_params)





class GPolygon(GOverlayBase):

django/forms/forms.py

+3 −7
Original line number Diff line number Diff line
@@ -18,7 +18,7 @@ from django.utils.deprecation import RemovedInDjango19Warning 
from django.utils.encoding import (

    force_text, python_2_unicode_compatible, smart_text,

)

from django.utils.html import conditional_escape, format_html

from django.utils.html import conditional_escape, format_html, html_safe

from django.utils.safestring import mark_safe

from django.utils.translation import ugettext as _
@@ -108,6 +108,7 @@ class DeclarativeFieldsMetaclass(MediaDefiningClass): 
        return new_class





@html_safe

@python_2_unicode_compatible

class BaseForm(object):

    # This is the main implementation of all the Form logic. Note that this
@@ -138,9 +139,6 @@ class BaseForm(object): 
        self.fields = copy.deepcopy(self.base_fields)

        self._bound_fields_cache = {}



    def __html__(self):

        return force_text(self)



    def __str__(self):

        return self.as_table()
@@ -520,6 +518,7 @@ class Form(six.with_metaclass(DeclarativeFieldsMetaclass, BaseForm)): 
    # BaseForm itself has no way of designating self.fields.





@html_safe

@python_2_unicode_compatible

class BoundField(object):

    "A Field plus data"
@@ -537,9 +536,6 @@ class BoundField(object): 
        self.help_text = field.help_text or ''

        self._initial_value = UNSET



    def __html__(self):

        return force_text(self)



    def __str__(self):

        """Renders this field as an HTML widget."""

        if self.field.show_hidden_initial:

django/forms/formsets.py

+2 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ from django.forms.widgets import HiddenInput 
from django.utils import six

from django.utils.encoding import python_2_unicode_compatible

from django.utils.functional import cached_property

from django.utils.html import html_safe

from django.utils.safestring import mark_safe

from django.utils.six.moves import range

from django.utils.translation import ugettext as _, ungettext
@@ -46,6 +47,7 @@ class ManagementForm(Form): 
        super(ManagementForm, self).__init__(*args, **kwargs)





@html_safe

@python_2_unicode_compatible

class BaseFormSet(object):

    """

django/forms/utils.py

+3 −1
Original line number Diff line number Diff line
@@ -9,7 +9,7 @@ from django.conf import settings 
from django.core.exceptions import ValidationError

from django.utils import six, timezone

from django.utils.encoding import force_text, python_2_unicode_compatible

from django.utils.html import escape, format_html, format_html_join

from django.utils.html import escape, format_html, format_html_join, html_safe

from django.utils.translation import ugettext_lazy as _



try:
@@ -42,6 +42,7 @@ def flatatt(attrs): 
    )





@html_safe

@python_2_unicode_compatible

class ErrorDict(dict):

    """
@@ -74,6 +75,7 @@ class ErrorDict(dict): 
        return self.as_ul()





@html_safe

@python_2_unicode_compatible

class ErrorList(UserList, list):

    """