Commit 4decf03f authored by Luke Plant's avatar Luke Plant
Browse files

Fixed #11502 - wrong escaping in admin. 

 
Thanks Tomasz Elendt.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@11497 bcc190cf-cafb-0310-a4f2-bffc1f526a37
parent 49cf7f4a

django/contrib/admin/templatetags/admin_list.py

+1 −1
Original line number Diff line number Diff line
@@ -265,7 +265,7 @@ def date_hierarchy(cl): 
        day_lookup = cl.params.get(day_field)

        year_month_format, month_day_format = get_partial_date_formats()



        link = lambda d: mark_safe(cl.get_query_string(d, [field_generic]))

        link = lambda d: cl.get_query_string(d, [field_generic])



        if year_lookup and month_lookup and day_lookup:

            day = datetime.date(int(year_lookup), int(month_lookup), int(day_lookup))

django/contrib/admin/widgets.py

+2 −1
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ import copy 
from django import forms

from django.forms.widgets import RadioFieldRenderer

from django.forms.util import flatatt

from django.utils.html import escape

from django.utils.text import truncate_words

from django.utils.translation import ugettext as _

from django.utils.safestring import mark_safe
@@ -148,7 +149,7 @@ class ForeignKeyRawIdWidget(forms.TextInput): 
    def label_for_value(self, value):

        key = self.rel.get_related_field().name

        obj = self.rel.to._default_manager.get(**{key: value})

        return '&nbsp;<strong>%s</strong>' % truncate_words(obj, 14)

        return '&nbsp;<strong>%s</strong>' % escape(truncate_words(obj, 14))



class ManyToManyRawIdWidget(ForeignKeyRawIdWidget):

    """