Ticket #2006: patch.diff

django/contrib/admin/templates/admin/filter.html

@@ -3 +3 @@
 <ul>
 {% for choice in choices %}
     <li{% if choice.selected %} class="selected"{% endif %}>
-    <a href="{{ choice.query_string }}">{{ choice.display }}</a></li>
+    <a href="{{ choice.query_string }}">{{ choice.display|escape }}</a></li>
 {% endfor %}
 </ul>

django/contrib/admin/templates/admin/change_form.html

@@ -12 +12 @@
 <div class="breadcrumbs">
      <a href="../../../">{% trans "Home" %}</a> &rsaquo;
      <a href="../">{{ opts.verbose_name_plural|capfirst }}</a> &rsaquo;
-     {% if add %}{% trans "Add" %} {{ opts.verbose_name }}{% else %}{{ original|striptags|truncatewords:"18" }}{% endif %}
+     {% if add %}{% trans "Add" %} {{ opts.verbose_name }}{% else %}{{ original|truncatewords:"18"|escape }}{% endif %}
 </div>
 {% endif %}{% endblock %}
 {% block content %}<div id="content-main">