Opened 19 years ago

Last modified 19 years ago

#2020 closed defect

Choices are not escaped — at Version 2

Reported by: tom@… Owned by: Adrian Holovaty
Component: Core (Other) Version:
Severity: normal Keywords:
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by Adrian Holovaty)

Choices are not escaped correctly.

Here's a patch:

Index: forms/__init__.py
===================================================================
--- forms/__init__.py   (revision 2997)
+++ forms/__init__.py   (working copy)
@@ -577,7 +577,7 @@
             selected_html = ''
             if str(value) in str_data_list:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, choice))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(choice)))
         output.append('  </select>')
         return '\n'.join(output)

Change History (2)

comment:1 by anonymous, 19 years ago

Sorry, should have done a "Preview" first.

Index: forms/__init__.py
===================================================================
--- forms/__init__.py   (revision 2997)
+++ forms/__init__.py   (working copy)
@@ -577,7 +577,7 @@
             selected_html = ''
             if str(value) in str_data_list:
                 selected_html = ' selected="selected"'
-            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, choice))
+            output.append('    <option value="%s"%s>%s</option>' % (escape(value), selected_html, escape(choice)))
         output.append('  </select>')
         return '\n'.join(output)

comment:2 by Adrian Holovaty, 19 years ago

Description: modified (diff)

(Fixed formatting in description.)

Note: See TracTickets for help on using tickets.
Back to Top