Commit 845817b0 authored by Tim Graham's avatar Tim Graham
Browse files

Fixed #24466 -- Added JavaScript escaping in a couple places in the admin. 

Thanks Aymeric Augustin and Florian Apolloner for work on the patch.
parent b86abbce

django/contrib/admin/options.py

+2 −3
Original line number Diff line number Diff line
@@ -1051,9 +1051,8 @@ class ModelAdmin(BaseModelAdmin): 
                attr = obj._meta.pk.attname

            value = obj.serializable_value(attr)

            return SimpleTemplateResponse('admin/popup_response.html', {

                'pk_value': escape(pk_value),  # for possible backwards-compatibility

                'value': escape(value),

                'obj': escapejs(obj)

                'value': value,

                'obj': obj,

            })



        elif "_continue" in request.POST:

django/contrib/admin/templates/admin/edit_inline/stacked.html

+4 −4
Original line number Diff line number Diff line
@@ -21,10 +21,10 @@ 


<script type="text/javascript">

(function($) {

  $("#{{ inline_admin_formset.formset.prefix }}-group .inline-related").stackedFormset({

    prefix: '{{ inline_admin_formset.formset.prefix }}',

    deleteText: "{% trans "Remove" %}",

    addText: "{% blocktrans with verbose_name=inline_admin_formset.opts.verbose_name|capfirst %}Add another {{ verbose_name }}{% endblocktrans %}"

  $("#{{ inline_admin_formset.formset.prefix|escapejs }}-group .inline-related").stackedFormset({

    prefix: "{{ inline_admin_formset.formset.prefix|escapejs }}",

    deleteText: "{% filter escapejs %}{% trans "Remove" %}{% endfilter %}",

    addText: "{% filter escapejs %}{% blocktrans with verbose_name=inline_admin_formset.opts.verbose_name|capfirst %}Add another {{ verbose_name }}{% endblocktrans %}{% endfilter %}"

  });

})(django.jQuery);

</script>

django/contrib/admin/templates/admin/edit_inline/tabular.html

+4 −4
Original line number Diff line number Diff line
@@ -74,10 +74,10 @@ 
<script type="text/javascript">



(function($) {

  $("#{{ inline_admin_formset.formset.prefix }}-group .tabular.inline-related tbody tr").tabularFormset({

    prefix: "{{ inline_admin_formset.formset.prefix }}",

    addText: "{% blocktrans with inline_admin_formset.opts.verbose_name|capfirst as verbose_name %}Add another {{ verbose_name }}{% endblocktrans %}",

    deleteText: "{% trans 'Remove' %}"

  $("#{{ inline_admin_formset.formset.prefix|escapejs }}-group .tabular.inline-related tbody tr").tabularFormset({

    prefix: "{{ inline_admin_formset.formset.prefix|escapejs }}",

    addText: "{% filter escapejs %}{% blocktrans with inline_admin_formset.opts.verbose_name|capfirst as verbose_name %}Add another {{ verbose_name }}{% endblocktrans %}{% endfilter %}",

    deleteText: "{% filter escapejs %}{% trans 'Remove' %}{% endfilter %}"

  });

})(django.jQuery);

</script>

django/contrib/admin/templates/admin/popup_response.html

+3 −3
Original line number Diff line number Diff line
@@ -4,11 +4,11 @@ 
  <body>

    <script type="text/javascript">

      {% if action == 'change' %}

        opener.dismissChangeRelatedObjectPopup(window, "{{ value }}", "{{ obj }}", "{{ new_value }}");

        opener.dismissChangeRelatedObjectPopup(window, "{{ value|escapejs }}", "{{ obj|escapejs }}", "{{ new_value|escapejs }}");

      {% elif action == 'delete' %}

        opener.dismissDeleteRelatedObjectPopup(window, "{{ value }}");

        opener.dismissDeleteRelatedObjectPopup(window, "{{ value|escapejs }}");

      {% else %}

        opener.dismissAddRelatedObjectPopup(window, "{{ value }}", "{{ obj }}");

        opener.dismissAddRelatedObjectPopup(window, "{{ value|escapejs }}", "{{ obj|escapejs }}");

      {% endif %}

    </script>

  </body>

django/contrib/admin/widgets.py

+2 −2
Original line number Diff line number Diff line
@@ -15,7 +15,7 @@ from django.template.loader import render_to_string 
from django.utils import six

from django.utils.encoding import force_text

from django.utils.html import (

    escape, format_html, format_html_join, smart_urlquote,

    escape, escapejs, format_html, format_html_join, smart_urlquote,

)

from django.utils.safestring import mark_safe

from django.utils.text import Truncator
@@ -50,7 +50,7 @@ class FilteredSelectMultiple(forms.SelectMultiple): 
        # TODO: "id_" is hard-coded here. This should instead use the correct

        # API to determine the ID dynamically.

        output.append('SelectFilter.init("id_%s", "%s", %s); });</script>\n'

            % (name, self.verbose_name.replace('"', '\\"'), int(self.is_stacked)))

            % (name, escapejs(self.verbose_name), int(self.is_stacked)))

        return mark_safe(''.join(output))