Opened 15 years ago

Closed 15 years ago

#11502 closed (fixed)

Wrong escaping in admin

Reported by: Tomasz Elendt <tomasz.elendt@…> Owned by: nobody
Component: contrib.admin Version: dev
Severity: Keywords:
Cc: tomasz.elendt@…, rlaager@… Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

There are some places (I found two of them) in Django's admin where querystrings used in templates are marked as safe, which prevents them from auto-escaping. In effect there's unescaped ampersand, when there's more than one variable in querystring. It's hard for me to instruct how to reproduce this bug - IMHO the easiest way is to set your DEFAULT_CONTENT_TYPE to 'application/xhtml+xml' and click through the change list page of the admin (date_hierarchy menu, paginator).

There are also some formatting issues (e.g. some very long lines) in admin_list.py.

Attachments (3)

admin_querysting_escaping.diff​ (1.2 KB ) - added by anonymous 15 years ago.
admin_escaping.diff​ (2.1 KB ) - added by Tomasz Elendt <tomasz.elendt@…> 15 years ago.
Pulled changes from #11583
django_escaping.diff​ (1.6 KB ) - added by Tomasz Elendt <tomasz.elendt@…> 15 years ago.
Updated patch

Download all attachments as: .zip

Change History (7)

by anonymous, 15 years ago

Attachment: admin_querysting_escaping.diff​ added

by Tomasz Elendt <tomasz.elendt@…>, 15 years ago

Attachment: admin_escaping.diff​ added

Pulled changes from #11583

comment:1 by anonymous, 15 years ago

Cc: rlaager@… added

comment:2 by Alex Gaynor, 15 years ago

Triage Stage: Unreviewed → Accepted

comment:3 by Tomasz Elendt <tomasz.elendt@…>, 15 years ago

One of the fixes in this patch has been pushed into trunk in r11486 (Ticket #11252). Attached patch need to be changed so that could be aplied on trunk in current state.

by Tomasz Elendt <tomasz.elendt@…>, 15 years ago

Attachment: django_escaping.diff​ added

Updated patch

comment:4 by Luke Plant, 15 years ago

Resolution: → fixed
Status: new → closed

(In [11497]) Fixed #11502 - wrong escaping in admin.

Thanks Tomasz Elendt.

Note: See TracTickets for help on using tickets.
Back to Top