Django

Code

Ticket #2020 (closed: fixed)

Opened 2 years ago

Last modified 2 years ago

Choices are not escaped

Reported by: tom@eggdrop.ch Assigned to: adrian
Milestone: Component: Core framework
Version: Keywords:
Cc: Triage Stage: Unreviewed
Has patch: 0 Needs documentation: 0
Needs tests: 0 Patch needs improvement: 0

Description (Last modified by adrian)

Choices are not escaped correctly.

Here's a patch: 

Index: forms/__init__.py
===================================================================
--- forms/__init__.py   (revision 2997)
+++ forms/__init__.py   (working copy)
@@ -577,7 +577,7 @@
             selected_html = ''
             if str(value) in str_data_list:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, choice))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(choice)))
         output.append('  </select>')
         return '\n'.join(output)

Attachments

Change History

05/27/06 07:23:13 changed by anonymous

Sorry, should have done a "Preview" first. 

Index: forms/__init__.py
===================================================================
--- forms/__init__.py   (revision 2997)
+++ forms/__init__.py   (working copy)
@@ -577,7 +577,7 @@
             selected_html = ''
             if str(value) in str_data_list:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, choice))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(choice)))
         output.append('  </select>')
         return '\n'.join(output)

05/31/06 09:53:48 changed by adrian

  • description changed.

(Fixed formatting in description.)

05/31/06 09:58:20 changed by adrian

  • status changed from new to closed.
  • resolution set to fixed.

(In [3021]) Fixed #2020 -- <option> values are now escaped in SelectMultipleField?

Add/Change #2020 (Choices are not escaped)




Change Properties
Action