id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
6160	Escaping of validation errors	Petr Marhoun <petr.marhoun@…>	Karen Tracey	"Error classes from django.newforms.utils.py don't escape error messages:

{{{
#!python
class ErrorList(list, StrAndUnicode):

    def as_ul(self):
        if not self: return u''
        return mark_safe(u'<ul class=""errorlist"">%s</ul>'
                % ''.join([u'<li>%s</li>' % force_unicode(e) for e in self]))
}}}

I don't thing that author of validation error (or translator) should use html escaping - message can be used in another context. But utility method as_ul is for html so I think it should escape it.

I am not sure if my patch is the right solution but it works for me.
"		closed	Forms	dev		fixed	easy-pickings		Accepted	1	0	0	0	0	0