Changes between Initial Version and Version 2 of Ticket #10912


Ignore:
Timestamp:
Apr 26, 2009, 3:36:20 PM (15 years ago)
Author:
Malcolm Tredinnick
Comment:

Hmm. This is a bit of a slight change in policy, but not necessarily a bad one (right now, intentionally, only filters autoescape). However,

  1. Import _render_change_in_context() smells and not of roses. Needs to be renamed or not imported or something. That leading underscore is a big clue.
  2. We need something similar to the autoescape parameter that is passed to filters, so that template tags do not autoescape results when they are being used inside a block that does not do auto-escaping.

I guess template tags know whether they're putting the results into the context -- which means the output shouldn't be autoescaped, since it will be autoescaped on output and you don't know at template tag usage time whether output will involve auto-escaping or not, so it must be delayed until rendering -- or directly displaying the results? I suspect so, but that's something to think about and confirm.

What are the backwards compatibility issues here? In particular, right now, a template tag doesn't have to care about calling mark_safe() on the result, since it just inserts it into the template. If you add the auto-escaping behaviour at the wrong place, you'll undo that and a lot of existing template tags will break. That's going to be a little fiddly to work around.

I'm unenthusiastic about fixing just this single tag, since it does change the currently consistent behaviour across all template tags. I'm more enthusiastic about addressing the general issue, but it's a lot more tricky. I'm really enthusiastic about you doing it, Andrew, since I know you guys work in the template space a lot, so the results will have some validity and it means I don't have to work on this (that latter point is important to me; maybe less so to you).

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #10912

    • Property Cc Malcolm Tredinnick added
    • Property Patch needs improvement set
    • Property Triage Stage UnreviewedAccepted
    • Property Summary firstof template tag should autoescape variablesAutoescaping variable input in template tags
  • Ticket #10912 – Description

    initial v2  
     1(revised description)
     2
     3When variables are used as input to template tags, we should handle autoescaping a bit better.
     4
     5Original description was even shorter:
     6
    17I'd expect firstof to escape variables.
Back to Top