#20211 closed Bug (fixed)
BoundField.label_tag now always escapes its `contents` parameter.
| Reported by: | Baptiste Mispelon | Owned by: | Baptiste Mispelon |
|---|---|---|---|
| Component: | Documentation | Version: | 1.5 |
| Severity: | Release blocker | Keywords: | |
| Cc: | Triage Stage: | Accepted | |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
This behavior changed between 1.4 and 1.5:
class FooForm(forms.Form): foo = forms.CharField() print FooForm().foo.label_tag('<asdf>')
In 1.4, the output of the previous code was this:
<label for="id_foo"><asdf></label>
In 1.5, we get this:
<label for="id_foo"><asdf></label>
This was changed by commit a92e7f37c4ae84b6b8d8016cc6783211e9047219.
I think the original intention was to not escape the content if it was provided, as indicated by the first line of the method (https://github.com/django/django/blob/master/django/forms/forms.py#L522):
contents = contents or conditional_escape(self.label)
This conditional escape is rendered moot by the use of format_html later on (introduced by the commit I linked above), which escapes everything anyway.
Change History (6)
comment:1 by , 13 years ago
| Component: | Forms → Documentation |
|---|---|
| Has patch: | set |
comment:2 by , 13 years ago
| Triage Stage: | Unreviewed → Ready for checkin |
|---|
comment:3 by , 13 years ago
| Severity: | Normal → Release blocker |
|---|---|
| Triage Stage: | Ready for checkin → Accepted |
I've discovered that the PR also inadvertently fixes a regression between 1.4 and 1.5, where the label was escaped twice if it's a lazily-translated string (from ugettext_lazy).
I've added another test to check for that behavior so I'm removing the RFC status.
comment:4 by , 13 years ago
After a comment from claudep, I removed the accidental fix for the regression.
The regression will be fixed with #20221 by fixing conditional_escape which is the root cause of this bug.
I've also added some more test for when a field as no id, which triggers a different code path in label_tag which wasn't tested before.
comment:5 by , 13 years ago
| Resolution: | → fixed |
|---|---|
| Status: | new → closed |
Well it turned out the behavior is intended, since the docstring of the method now reads:
So I made a pull request that adds a note in the backwards-incompatible changes of the 1.5 release notes.
I also added some tests for the
label_tagfunctionalities (it didn't seem to be tested very much) and removed a call toconditional_escapethat was not needed since everything gets escaped byformat_htmllater on.The pull request is there: https://github.com/django/django/pull/997