Ticket #4131: patch_4131.diff

django/template/defaultfilters.py

@@ -36 +36 @@
-
-
-def addslashes(value):
-Adds slashes - useful for passing strings to
+Backslash-escapes backslashes and quotes - useful for passing strings to CSV or
-    return value.replace('\\', '\\\\').replace('"', '\\"').replace("'", "\\'")
-addslashes = stringfilter(addslashes)
-
@@ -45 +45 @@
-    return value and value[0].upper() + value[1:]
-capfirst = stringfilter(capfirst)
-
+def escapejs(value):
+    "Backslash-escapes characters disallowed from JavaScript strings."
+    maps = (
+        ('\\', '\\\\'),
+        ('"', '\\"'),
+        ("'", "\\'"),
+        ('\n', '\\n'),
+        ('\r', '\\r'),
+        ('\b', '\\b'),
+        ('\f', '\\f'),
+        ('\t', '\\t'),
+        ('\v', '\\v'),
+        ('</', '<\\/'),
+        )
+    for bad, good in maps:
+        value = value.replace(bad, good)
+    return value
+escapejs = stringfilter(escapejs)
+
-def fix_ampersands(value):
-    "Replaces ampersands with ``&amp;`` entities"
-    from django.utils.html import fix_ampersands

tests/regressiontests/defaultfilters/tests.py

@@ -43 +43 @@
->>> capfirst(u'hello world')
-u'Hello world'
-
+>>> escapejs(u'"double quotes" and \'single quotes\'')
+u'\\"double quotes\\" and \\\'single quotes\\\''
+
+>>> escapejs(ur'\ : backslashes, too')
+u'\\\\ : backslashes, too'
+
+>>> escapejs(u'and lots of whitespace: \r\n\t\v\f\b')
+u'and lots of whitespace: \\r\\n\\t\\v\\f\\b'
+
+>>> escapejs(ur'<script>and this</script>')
+u'<script>and this<\\/script>'
+
->>> fix_ampersands(u'Jack & Jill & Jeroboam')
-u'Jack &amp; Jill &amp; Jeroboam'
-

docs/templates.txt

@@ -996 +996 @@
-addslashes
-~~~~~~~~~~
-
-Adds slashes. Useful for passing strings to JavaScript, for example
+Backslash-escapes backslashes and quotes - useful for passing strings to CSV or JavaScript, for example.  `escapejs` is preferable for passing strings to JavaScript
-
-
-capfirst
-~~~~~~~~
-
@@ -1057 +1056 @@
-    * ``'"'`` (double quote) to ``'"'``
-    * ``"'"`` (single quote) to ``'''``
-
+escapejs
+~~~~~~~~
+
+Backslash-escapes characters disallowed from JavaScript strings.  It makes these changes:
+
+        * ``\`` to ``\\``
+        * ``"`` to ``\"``
+        * ``'`` to ``\'``
+        * *line feed* to ``\n``
+        * *carriage return* to ``\r``
+        * *backspace* to ``\b``
+        * *form feed* to ``\f``
+        * *tab* to ``\t``
+        * *vertical tab* to ``\v``
+        * ``</`` to ``<\/``
+
-filesizeformat
-~~~~~~~~~~~~~~
-