Ticket #16684: django_forms_forms.py.diff

django/forms/forms.py

@@ -153 +153 @@
                 # CSS classes applied.
                 css_classes = bf.css_classes()
                 if css_classes:
-                    html_class_attr = ' class="%s"' % css_classes
+                    html_class_attr = ' class="%s"' % conditional_escape(css_classes)
 
                 if errors_on_separate_row and bf_errors:
                     output.append(error_row % force_unicode(bf_errors))