Ticket #2359: 03-admin-changes.2.diff

File 03-admin-changes.2.diff, 30.9 KB (added by Michael Radziej <mir@…>, 18 years ago)

updated patch

  • django/contrib/admin/filterspecs.py 

    unchanged:
    a b certain test -- e.g. being a DateField o  
    77"""
    88
    99from django.db import models
     10from django.utils import html
    1011import datetime
    1112
    1213class FilterSpec(object):
    … … class FilterSpec(object):  
    3738    def output(self, cl):
    3839        t = []
    3940        if self.has_output():
    40             t.append(_('<h3>By %s:</h3>\n<ul>\n') % self.title())
     41            t.append(_('<h3>By %s:</h3>\n<ul>\n') % html.escape(self.title()))
    4142
    4243            for choice in self.choices(cl):
    4344                t.append('<li%s><a href="%s">%s</a></li>\n' % \

  • django/contrib/admin/models.py 

    unchanged:
    a b from django.db import models  
    22from django.contrib.contenttypes.models import ContentType
    33from django.contrib.auth.models import User
    44from django.utils.translation import gettext_lazy as _
     5from django.utils.safestring import mark_safe
    56
    67ADDITION = 1
    78CHANGE = 2
    … … class LogEntry(models.Model):  
    4849        Returns the admin URL to edit the object represented by this log entry.
    4950        This is relative to the Django admin index page.
    5051        """
    51         return "%s/%s/%s/" % (self.content_type.app_label, self.content_type.model, self.object_id)
     52        return mark_safe("%s/%s/%s/" % (self.content_type.app_label, self.content_type.model, self.object_id))

  • django/contrib/admin/templates/admin/base.html 

    unchanged:
    a b  
    1313<body class="{% if is_popup %}popup {% endif %}{% block bodyclass %}{% endblock %}">
    1414
    1515<!-- Container -->
     16{% autoescape %}
    1617<div id="container">
    1718
    1819    {% if not is_popup %}
    … …  
    2223        {% block branding %}{% endblock %}
    2324        </div>
    2425        {% if user.is_authenticated and user.is_staff %}
    25         <div id="user-tools">{% trans 'Welcome,' %} <strong>{% if user.first_name %}{{ user.first_name|escape }}{% else %}{{ user.username }}{% endif %}</strong>. {% block userlinks %}<a href="doc/">{% trans 'Documentation' %}</a> / <a href="password_change/">{% trans 'Change password' %}</a> / <a href="logout/">{% trans 'Log out' %}</a>{% endblock %}</div>
     26        <div id="user-tools">{% trans 'Welcome,' %} <strong>{% if user.first_name %}{{ user.first_name }}{% else %}{{ user.username }}{% endif %}</strong>. {% block userlinks %}<a href="doc/">{% trans 'Documentation' %}</a> / <a href="password_change/">{% trans 'Change password' %}</a> / <a href="logout/">{% trans 'Log out' %}</a>{% endblock %}</div>
    2627        {% endif %}
    2728        {% block nav-global %}{% endblock %}
    2829    </div>
    2930    <!-- END Header -->
    30     {% block breadcrumbs %}<div class="breadcrumbs"><a href="/">{% trans 'Home' %}</a>{% if title %} &rsaquo; {{ title|escape }}{% endif %}</div>{% endblock %}
     31    {% block breadcrumbs %}<div class="breadcrumbs"><a href="/">{% trans 'Home' %}</a>{% if title %} &rsaquo; {{ title }}{% endif %}</div>{% endblock %}
    3132    {% endif %}
    3233
    3334        {% if messages %}
    34         <ul class="messagelist">{% for message in messages %}<li>{{ message|escape }}</li>{% endfor %}</ul>
     35        <ul class="messagelist">{% for message in messages %}<li>{{ message }}</li>{% endfor %}</ul>
    3536        {% endif %}
    3637
    3738    <!-- Content -->
    … …  
    4243        {% block object-tools %}{% endblock %}
    4344        {{ content }}
    4445        {% endblock %}
     46        {% block content_title %}{% if title %}<h1>{{ title }}</h1>{% endif %}{% endblock %}
     47        {% block content %}{{ content }}{% endblock %}
    4548        {% block sidebar %}{% endblock %}
    4649        <br class="clear" />
    4750    </div>
    … …  
    4952
    5053    {% block footer %}<div id="footer"></div>{% endblock %}
    5154</div>
     55{% endautoescape %}
    5256<!-- END Container -->
    5357
    5458</body>

  • django/contrib/admin/templates/admin/base_site.html 

    unchanged:
    a b  
    11{% extends "admin/base.html" %}
    22{% load i18n %}
    33
    4 {% block title %}{{ title|escape }} | {% trans 'Django site admin' %}{% endblock %}
     4{% block title %}{{ title }} | {% trans 'Django site admin' %}{% endblock %}
    55
    66{% block branding %}
    77<h1 id="site-name">{% trans 'Django administration' %}</h1>

  • django/contrib/admin/templates/admin/change_form.html 

    unchanged:
    a b  
    1111{% block breadcrumbs %}{% if not is_popup %}
    1212<div class="breadcrumbs">
    1313     <a href="../../../">{% trans "Home" %}</a> &rsaquo;
    14      <a href="../">{{ opts.verbose_name_plural|capfirst|escape }}</a> &rsaquo;
    15      {% if add %}{% trans "Add" %} {{ opts.verbose_name|escape }}{% else %}{{ original|truncatewords:"18"|escape }}{% endif %}
     14     <a href="../">{{ opts.verbose_name_plural|capfirst }}</a> &rsaquo;
     15     {% if add %}{% trans "Add" %} {{ opts.verbose_name }}{% else %}{{ original|truncatewords:"18" }}{% endif %}
    1616</div>
    1717{% endif %}{% endblock %}
    1818{% block content %}<div id="content-main">

  • django/contrib/admin/templates/admin/change_list.html 

    unchanged:
    a b  
    33{% block stylesheet %}{% admin_media_prefix %}css/changelists.css{% endblock %}
    44{% block bodyclass %}change-list{% endblock %}
    55{% block userlinks %}<a href="../../doc/">{% trans 'Documentation' %}</a> / <a href="../../password_change/">{% trans 'Change password' %}</a> / <a href="../../logout/">{% trans 'Log out' %}</a>{% endblock %}
    6 {% if not is_popup %}{% block breadcrumbs %}<div class="breadcrumbs"><a href="../../">{% trans "Home" %}</a> &rsaquo; {{ cl.opts.verbose_name_plural|capfirst|escape }}</div>{% endblock %}{% endif %}
     6{% if not is_popup %}{% block breadcrumbs %}<div class="breadcrumbs"><a href="../../">{% trans "Home" %}</a> &rsaquo; {{ cl.opts.verbose_name_plural|capfirst }}</div>{% endblock %}{% endif %}
    77{% block coltype %}flex{% endblock %}
    88{% block content %}
    99<div id="content-main">

  • django/contrib/admin/templates/admin/date_hierarchy.html 

    unchanged:
    a b  
    11{% if show %}
    22<div class="xfull">
    33<ul class="toplinks">
    4 {% if back %}<li class="date-back"><a href="{{ back.link }}">&lsaquo; {{ back.title|escape }}</a></li>{% endif %}
     4{% if back %}<li class="date-back"><a href="{{ back.link }}">&lsaquo; {{ back.title }}</a></li>{% endif %}
    55{% for choice in choices %}
    6 <li> {% if choice.link %}<a href="{{ choice.link }}">{% endif %}{{ choice.title|escape }}{% if choice.link %}</a>{% endif %}</li>
     6<li> {% if choice.link %}<a href="{{ choice.link }}">{% endif %}{{ choice.title }}{% if choice.link %}</a>{% endif %}</li>
    77{% endfor %}
    88</ul><br class="clear" />
    99</div>

  • django/contrib/admin/templates/admin/delete_confirmation.html 

    unchanged:
    a b  
    44{% block breadcrumbs %}
    55<div class="breadcrumbs">
    66     <a href="../../../../">{% trans "Home" %}</a> &rsaquo;
    7      <a href="../../">{{ opts.verbose_name_plural|capfirst|escape }}</a> &rsaquo;
     7     <a href="../../">{{ opts.verbose_name_plural|capfirst }}</a> &rsaquo;
    88     <a href="../">{{ object|escape|truncatewords:"18" }}</a> &rsaquo;
    99     {% trans 'Delete' %}
    1010</div>
    … …  
    1414    <p>{% blocktrans with object|escape as escaped_object %}Deleting the {{ object_name }} '{{ escaped_object }}' would result in deleting related objects, but your account doesn't have permission to delete the following types of objects:{% endblocktrans %}</p>
    1515    <ul>
    1616    {% for obj in perms_lacking %}
    17         <li>{{ obj|escape }}</li>
     17        <li>{{ obj }}</li>
    1818    {% endfor %}
    1919    </ul>
    2020{% else %}

  • django/contrib/admin/templates/admin/edit_inline_stacked.html 

    unchanged:
    a b  
    11{% load admin_modify %}
    22<fieldset class="module aligned">
    33   {% for fcw in bound_related_object.form_field_collection_wrappers %}
    4       <h2>{{ bound_related_object.relation.opts.verbose_name|capfirst|escape }}&nbsp;#{{ forloop.counter }}</h2>
     4      <h2>{{ bound_related_object.relation.opts.verbose_name|capfirst }}&nbsp;#{{ forloop.counter }}</h2>
    55      {% if bound_related_object.show_url %}{% if fcw.obj.original %}
    66      <p><a href="/r/{{ fcw.obj.original.content_type_id }}/{{ fcw.obj.original.id }}/">View on site</a></p>
    77      {% endif %}{% endif %}

  • django/contrib/admin/templates/admin/edit_inline_tabular.html 

    unchanged:
    a b  
    11{% load admin_modify %}
    22<fieldset class="module">
    3    <h2>{{ bound_related_object.relation.opts.verbose_name_plural|capfirst|escape }}</h2><table>
     3   <h2>{{ bound_related_object.relation.opts.verbose_name_plural|capfirst }}</h2><table>
    44   <thead><tr>
    55   {% for fw in bound_related_object.field_wrapper_list %}
    66      {% if fw.needs_header %}
    7          <th{{ fw.header_class_attribute }}>{{ fw.field.verbose_name|capfirst|escape }}</th>
     7         <th{{ fw.header_class_attribute }}>{{ fw.field.verbose_name|capfirst }}</th>
    88      {% endif %}
    99   {% endfor %}
    1010   </tr></thead>

  • django/contrib/admin/templates/admin/filter.html 

    unchanged:
    a b  
    33<ul>
    44{% for choice in choices %}
    55    <li{% if choice.selected %} class="selected"{% endif %}>
    6     <a href="{{ choice.query_string }}">{{ choice.display|escape }}</a></li>
     6    <a href="{{ choice.query_string|safe }}">{{ choice.display }}</a></li>
    77{% endfor %}
    88</ul>

  • django/contrib/admin/templates/admin/index.html 

    unchanged:
    a b  
    1919        {% for model in app.models %}
    2020            <tr>
    2121            {% if model.perms.change %}
    22                 <th scope="row"><a href="{{ model.admin_url }}">{{ model.name|escape }}</a></th>
     22                <th scope="row"><a href="{{ model.admin_url }}">{{ model.name }}</a></th>
    2323            {% else %}
    24                 <th scope="row">{{ model.name|escape }}</th>
     24                <th scope="row">{{ model.name }}</th>
    2525            {% endif %}
    2626
    2727            {% if model.perms.add %}
    … …  
    5858            {% else %}
    5959            <ul class="actionlist">
    6060            {% for entry in admin_log %}
    61                 <li class="{% if entry.is_addition %}addlink{% endif %}{% if entry.is_change %}changelink{% endif %}{% if entry.is_deletion %}deletelink{% endif %}">{% if not entry.is_deletion %}<a href="{{ entry.get_admin_url }}">{% endif %}{{ entry.object_repr|escape }}{% if not entry.is_deletion %}</a>{% endif %}<br /><span class="mini quiet">{{ entry.content_type.name|capfirst|escape }}</span></li>
     61                <li class="{% if entry.is_addition %}addlink{% endif %}{% if entry.is_change %}changelink{% endif %}{% if entry.is_deletion %}deletelink{% endif %}">{% if not entry.is_deletion %}<a href="{{ entry.get_admin_url }}">{% endif %}{{ entry.object_repr }}{% if not entry.is_deletion %}</a>{% endif %}<br /><span class="mini quiet">{{ entry.content_type.name|capfirst }}</span></li>
    6262            {% endfor %}
    6363            </ul>
    6464            {% endif %}

  • django/contrib/admin/templates/admin/invalid_setup.html 

    unchanged:
    a b  
    11{% extends "admin/base_site.html" %}
    22{% load i18n %}
    33
    4 {% block breadcrumbs %}<div class="breadcrumbs"><a href="../../">{% trans 'Home' %}</a> &rsaquo; {{ title|escape }}</div>{% endblock %}
     4{% block breadcrumbs %}<div class="breadcrumbs"><a href="../../">{% trans 'Home' %}</a> &rsaquo; {{ title }}</div>{% endblock %}
    55
    66{% block content %}
    77

  • django/contrib/admin/templates/admin/object_history.html 

    unchanged:
    a b  
    22{% load i18n %}
    33{% block userlinks %}<a href="../../../../doc/">{% trans 'Documentation' %}</a> / <a href="../../../../password_change/">{% trans 'Change password' %}</a> / <a href="../../../../logout/">{% trans 'Log out' %}</a>{% endblock %}
    44{% block breadcrumbs %}
    5 <div class="breadcrumbs"><a href="../../../../">{% trans 'Home' %}</a> &rsaquo; <a href="../../">{{ module_name|escape }}</a> &rsaquo; <a href="../">{{ object|escape|truncatewords:"18" }}</a> &rsaquo; {% trans 'History' %}</div>
     5<div class="breadcrumbs"><a href="../../../../">{% trans 'Home' %}</a> &rsaquo; <a href="../../">{{ module_name }}</a> &rsaquo; <a href="../">{{ object|truncatewords:"18" }}</a> &rsaquo; {% trans 'History' %}</div>
    66{% endblock %}
    77
    88{% block content %}
    … …  
    2424        {% for action in action_list %}
    2525        <tr>
    2626            <th scope="row">{{ action.action_time|date:_("DATE_WITH_TIME_FULL") }}</th>
    27             <td>{{ action.user.username }}{% if action.user.first_name %} ({{ action.user.first_name|escape }} {{ action.user.last_name|escape }}){% endif %}</td>
    28             <td>{{ action.change_message|escape }}</td>
     27            <td>{{ action.user.username }}{% if action.user.first_name %} ({{ action.user.first_name }} {{ action.user.last_name }}){% endif %}</td>
     28            <td>{{ action.change_message }}</td>
    2929        </tr>
    3030        {% endfor %}
    3131        </tbody>

  • django/contrib/admin/templates/admin/pagination.html 

    unchanged:
    a b  
    66    {% paginator_number cl i %}
    77{% endfor %}
    88{% endif %}
    9 {{ cl.result_count }} {% ifequal cl.result_count 1 %}{{ cl.opts.verbose_name|escape }}{% else %}{{ cl.opts.verbose_name_plural|escape }}{% endifequal %}
     9{{ cl.result_count }} {% ifequal cl.result_count 1 %}{{ cl.opts.verbose_name|escape }}{% else %}{{ cl.opts.verbose_name_plural }}{% endifequal %}
    1010{% if show_all_url %}&nbsp;&nbsp;<a href="{{ show_all_url }}" class="showall">{% trans 'Show all' %}</a>{% endif %}
    1111</p>

  • django/contrib/admin/templates/admin/search_form.html 

    unchanged:
    a b  
    44<div id="toolbar"><form id="changelist-search" action="" method="get">
    55<div><!-- DIV needed for valid HTML -->
    66<label for="searchbar"><img src="{% admin_media_prefix %}img/admin/icon_searchbox.png" alt="Search" /></label>
    7 <input type="text" size="40" name="{{ search_var }}" value="{{ cl.query|escape }}" id="searchbar" />
     7<input type="text" size="40" name="{{ search_var }}" value="{{ cl.query }}" id="searchbar" />
    88<input type="submit" value="{% trans 'Go' %}" />
    99{% if show_result_count %}
    1010    <span class="small quiet">{% blocktrans count cl.result_count as counter %}1 result{% plural %}{{ counter }} results{% endblocktrans %} (<a href="?{% if cl.is_popup %}pop=1{% endif %}">{% blocktrans with cl.full_result_count as full_result_count %}{{ full_result_count }} total{% endblocktrans %}</a>)</span>
    1111{% endif %}
    1212{% for pair in cl.params.items %}
    13     {% ifnotequal pair.0 search_var %}<input type="hidden" name="{{ pair.0|escape }}" value="{{ pair.1|escape }}"/>{% endifnotequal %}
     13    {% ifnotequal pair.0 search_var %}<input type="hidden" name="{{ pair.0 }}" value="{{ pair.1 }}"/>{% endifnotequal %}
    1414{% endfor %}
    1515</div>
    1616</form></div>

  • django/contrib/admin/templates/admin_doc/model_detail.html 

    unchanged:
    a b  
    99</style>
    1010{% endblock %}
    1111
    12 {% block breadcrumbs %}<div class="breadcrumbs"><a href="../../../">Home</a> &rsaquo; <a href="../../">Documentation</a> &rsaquo; <a href="../">Models</a> &rsaquo; {{ name|escape }}</div>{% endblock %}
     12{% block breadcrumbs %}<div class="breadcrumbs"><a href="../../../">Home</a> &rsaquo; <a href="../../">Documentation</a> &rsaquo; <a href="../">Models</a> &rsaquo; {{ name }}</div>{% endblock %}
    1313
    14 {% block title %}Model: {{ name|escape }}{% endblock %}
     14{% block title %}Model: {{ name }}{% endblock %}
    1515
    1616{% block content %}
    1717<div id="content-main">
    18 <h1>{{ summary|escape }}</h1>
     18<h1>{{ summary }}</h1>
    1919
    2020{% if description %}
    21   <p>{% filter escape|linebreaksbr %}{% trans description %}{% endfilter %}</p>
     21  <p>{% filter linebreaksbr %}{% trans description %}{% endfilter %}</p>
    2222{% endif %}
    2323
    2424<div class="module">

  • django/contrib/admin/templates/admin_doc/template_detail.html 

    unchanged:
    a b  
    11{% extends "admin/base_site.html" %}
    22{% load i18n %}
    3 {% block breadcrumbs %}<div class="breadcrumbs"><a href="../../../">Home</a> &rsaquo; <a href="../../">Documentation</a> &rsaquo; Templates &rsaquo; {{ name|escape }}</div>{% endblock %}
     3{% block breadcrumbs %}<div class="breadcrumbs"><a href="../../../">Home</a> &rsaquo; <a href="../../">Documentation</a> &rsaquo; Templates &rsaquo; {{ name }}</div>{% endblock %}
    44{% block userlinks %}<a href="../../../password_change/">{% trans 'Change password' %}</a> / <a href="../../../logout/">{% trans 'Log out' %}</a>{% endblock %}
    55
    6 {% block title %}Template: {{ name|escape }}{% endblock %}
     6{% block title %}Template: {{ name }}{% endblock %}
    77
    88{% block content %}
    9 <h1>Template: "{{ name|escape }}"</h1>
     9<h1>Template: "{{ name }}"</h1>
    1010
    1111{% regroup templates|dictsort:"site_id" by site as templates_by_site %}
    1212{% for group in templates_by_site %}
    13     <h2>Search path for template "{{ name|escape }}" on {{ group.grouper }}:</h2>
     13    <h2>Search path for template "{{ name }}" on {{ group.grouper }}:</h2>
    1414    <ol>
    1515    {% for template in group.list|dictsort:"order" %}
    16         <li><code>{{ template.file|escape }}</code>{% if not template.exists %} <em>(does not exist)</em>{% endif %}</li>
     16        <li><code>{{ template.file }}</code>{% if not template.exists %} <em>(does not exist)</em>{% endif %}</li>
    1717    {% endfor %}
    1818    </ol>
    1919{% endfor %}

  • django/contrib/admin/templates/widget/foreign.html 

    unchanged:
    a b  
    1515        {{ bound_field.original_value }}
    1616    {% endif %}
    1717    {% if bound_field.raw_id_admin %}
    18         {% if bound_field.existing_display %}&nbsp;<strong>{{ bound_field.existing_display|truncatewords:"14"|escape }}</strong>{% endif %}
     18        {% if bound_field.existing_display %}&nbsp;<strong>{{ bound_field.existing_display|truncatewords:"14" }}</strong>{% endif %}
    1919    {% endif %}
    2020{% endif %}

  • django/contrib/admin/templates/widget/one_to_one.html 

    unchanged:
    a b  
    11{% if add %}{% include "widget/foreign.html" %}{% endif %}
    2 {% if change %}{% if bound_field.existing_display %}&nbsp;<strong>{{ bound_field.existing_display|truncatewords:"14"|escape }}</strong>{% endif %}{% endif %}
     2{% if change %}{% if bound_field.existing_display %}&nbsp;<strong>{{ bound_field.existing_display|truncatewords:"14" }}</strong>{% endif %}{% endif %}

  • django/contrib/admin/templatetags/admin_list.py 

    unchanged:
    a b from django.db import models  
    66from django.utils import dateformat
    77from django.utils.html import escape
    88from django.utils.text import capfirst
     9from django.utils.safestring import mark_safe
    910from django.utils.translation import get_date_formats, get_partial_date_formats
    1011from django.template import Library
    1112import datetime
    … … def paginator_number(cl,i):  
    1819    if i == DOT:
    1920        return '... '
    2021    elif i == cl.page_num:
    21         return '<span class="this-page">%d</span> ' % (i+1)
     22        return mark_safe('<span class="this-page">%d</span> ' % (i+1))
    2223    else:
    23         return '<a href="%s"%s>%d</a> ' % (cl.get_query_string({PAGE_VAR: i}), (i == cl.paginator.pages-1 and ' class="end"' or ''), i+1)
     24        return mark_safe('<a href="%s"%s>%d</a> ' % (cl.get_query_string({PAGE_VAR: i}), (i == cl.paginator.pages-1 and ' class="end"' or ''), i+1))
    2425paginator_number = register.simple_tag(paginator_number)
    2526
    2627def pagination(cl):
    … … def items_for_result(cl, result):  
    177178            first = False
    178179            url = cl.url_for_result(result)
    179180            result_id = str(getattr(result, pk)) # str() is needed in case of 23L (long ints)
    180             yield ('<%s%s><a href="%s"%s>%s</a></%s>' % \
     181            yield mark_safe('<%s%s><a href="%s"%s>%s</a></%s>' % \
    181182                (table_tag, row_class, url, (cl.is_popup and ' onclick="opener.dismissRelatedLookupPopup(window, %r); return false;"' % result_id or ''), result_repr, table_tag))
    182183        else:
    183             yield ('<td%s>%s</td>' % (row_class, result_repr))
     184            yield mark_safe('<td%s>%s</td>' % (row_class, result_repr))
    184185
    185186def results(cl):
    186187    for res in cl.result_list:
    … … def date_hierarchy(cl):  
    204205        day_lookup = cl.params.get(day_field)
    205206        year_month_format, month_day_format = get_partial_date_formats()
    206207
    207         link = lambda d: cl.get_query_string(d, [field_generic])
     208        link = lambda d: mark_safe(cl.get_query_string(d, [field_generic]))
    208209
    209210        if year_lookup and month_lookup and day_lookup:
    210211            day = datetime.date(int(year_lookup), int(month_lookup), int(day_lookup))

  • django/contrib/admin/templatetags/admin_modify.py 

    unchanged:
    a b from django import template  
    22from django.contrib.admin.views.main import AdminBoundField
    33from django.template import loader
    44from django.utils.text import capfirst
     5from django.utils.html import escape
     6from django.utils.safestring import mark_safe
    57from django.db import models
    68from django.db.models.fields import Field
    79from django.db.models.related import BoundRelatedObject
    … … def include_admin_script(script_path):  
    2931        <script type="text/javascript" src="/media/admin/js/calendar.js">
    3032    """
    3133
    32     return '<script type="text/javascript" src="%s%s"></script>' % (settings.ADMIN_MEDIA_PREFIX, script_path)
     34    return mark_safe('<script type="text/javascript" src="%s%s"></script>' % (settings.ADMIN_MEDIA_PREFIX, script_path))
    3335include_admin_script = register.simple_tag(include_admin_script)
    3436
    3537def submit_row(context):
    … … def field_label(bound_field):  
    6062            class_names.append('inline')
    6163        colon = ":"
    6264    class_str = class_names and ' class="%s"' % ' '.join(class_names) or ''
    63     return '<label for="%s"%s>%s%s</label> ' % (bound_field.element_id, class_str, \
    64         capfirst(bound_field.field.verbose_name), colon)
     65    return mark_safe('<label for="%s"%s>%s%s</label> ' % (bound_field.element_id, class_str, \
     66        escape(capfirst(bound_field.field.verbose_name)), colon))
    6567field_label = register.simple_tag(field_label)
    6668
    6769class FieldWidgetNode(template.Node):
    … … def auto_populated_field_script(auto_pop  
    190192                     ' var e = document.getElementById("id_%s");' \
    191193                     ' if(!e._changed) { e.value = URLify(%s, %s);} }; ' % (
    192194                     f, field.name, add_values, field.maxlength))
    193     return ''.join(t)
     195    return mark_safe(''.join(t))
    194196auto_populated_field_script = register.simple_tag(auto_populated_field_script)
    195197
    196198def filter_interface_script_maybe(bound_field):
    197199    f = bound_field.field
    198200    if f.rel and isinstance(f.rel, models.ManyToManyRel) and f.rel.filter_interface:
    199         return '<script type="text/javascript">addEvent(window, "load", function(e) {' \
     201        return mark_safe('<script type="text/javascript">addEvent(window, "load", function(e) {' \
    200202              ' SelectFilter.init("id_%s", "%s", %s, "%s"); });</script>\n' % (
    201               f.name, f.verbose_name.replace('"', '\\"'), f.rel.filter_interface-1, settings.ADMIN_MEDIA_PREFIX)
     203              f.name, escape(f.verbose_name.replace('"', '\\"')), f.rel.filter_interface-1, settings.ADMIN_MEDIA_PREFIX)
    202204    else:
    203205        return ''
    204206filter_interface_script_maybe = register.simple_tag(filter_interface_script_maybe)

  • django/contrib/admin/utils.py 

    unchanged:
    a b  
    33import re
    44from email.Parser import HeaderParser
    55from email.Errors import HeaderParseError
     6from django.utils.safestring import mark_safe
    67try:
    78    import docutils.core
    89    import docutils.nodes
    … … def parse_rst(text, default_reference_co  
    6667    parts = docutils.core.publish_parts(text, source_path=thing_being_parsed,
    6768                destination_path=None, writer_name='html',
    6869                settings_overrides=overrides)
    69     return parts['fragment']
     70    return mark_safe(parts['fragment'])
    7071
    7172#
    7273# reST roles

  • django/contrib/admin/views/decorators.py 

    unchanged:
    a b def _display_login_form(request, error_m  
    2222        post_data = _encode_post_data({})
    2323    return render_to_response('admin/login.html', {
    2424        'title': _('Log in'),
    25         'app_path': request.path,
     25        'app_path': mark_safe(request.path),
    2626        'post_data': post_data,
    2727        'error_message': error_message
    2828    }, context_instance=template.RequestContext(request))

  • django/contrib/admin/views/doc.py 

    unchanged:
    a b from django.http import Http404, get_hos  
    99from django.core import urlresolvers
    1010from django.contrib.admin import utils
    1111from django.contrib.sites.models import Site
     12from django.utils.safestring import mark_safe
    1213import inspect, os, re
    1314
    1415# Exclude methods starting with these strings from documentation
    … … def bookmarklets(request):  
    2829    # Hack! This couples this view to the URL it lives at.
    2930    admin_root = request.path[:-len('doc/bookmarklets/')]
    3031    return render_to_response('admin_doc/bookmarklets.html', {
    31         'admin_url': "%s://%s%s" % (request.is_secure() and 'https' or 'http', get_host(request), admin_root),
     32        'admin_url': mark_safe("%s://%s%s" % (request.is_secure() and 'https' or 'http', get_host(request), admin_root)),
    3233    }, context_instance=RequestContext(request))
    3334bookmarklets = staff_member_required(bookmarklets)
    3435

  • django/contrib/admin/views/main.py 

    only in patch2:
unchanged:
    a b from django.db.models.query import handl  
    1212from django.http import Http404, HttpResponse, HttpResponseRedirect
    1313from django.utils.html import escape
    1414from django.utils.text import capfirst, get_text_list
     15from django.utils.safestring import mark_safe
    1516import operator
    1617
    1718from django.contrib.admin.models import LogEntry, ADDITION, CHANGE, DELETION
    … … class AdminBoundField(object):  
    129130        self._repr_filled = False
    130131
    131132        if field.rel:
    132             self.related_url = '../../../%s/%s/' % (field.rel.to._meta.app_label, field.rel.to._meta.object_name.lower())
     133            self.related_url = mark_safe('../../../%s/%s/' % (field.rel.to._meta.app_label, field.rel.to._meta.object_name.lower()))
    133134
    134135    def original_value(self):
    135136        if self.original:
    … … def render_change_form(model, manipulato  
    209210        'javascript_imports': get_javascript_imports(opts, auto_populated_fields, field_sets),
    210211        'ordered_objects': ordered_objects,
    211212        'inline_related_objects': inline_related_objects,
    212         'form_url': form_url,
     213        'form_url': mark_safe(form_url),
    213214        'opts': opts,
    214215        'content_type_id': ContentType.objects.get_for_model(model).id,
    215216    }
    … … def _get_deleted_objects(deleted_objects  
    432433                    nh(deleted_objects, current_depth, ['%s: %s' % (capfirst(related.opts.verbose_name), sub_obj), []])
    433434                else:
    434435                    # Display a link to the admin page.
    435                     nh(deleted_objects, current_depth, ['%s: <a href="../../../../%s/%s/%s/">%s</a>' % \
    436                         (capfirst(related.opts.verbose_name), related.opts.app_label, related.opts.object_name.lower(),
    437                         sub_obj._get_pk_val(), sub_obj), []])
     436                    nh(deleted_objects, current_depth, [mark_safe('%s: <a href="../../../../%s/%s/%s/">%s</a>' % \
     437                        (escape(capfirst(related.opts.verbose_name)), related.opts.app_label, related.opts.object_name.lower(),
     438                        sub_obj._get_pk_val(), escape(sub_obj))), []])
    438439                _get_deleted_objects(deleted_objects, perms_needed, user, sub_obj, related.opts, current_depth+2)
    439440        else:
    440441            has_related_objs = False
    … … def _get_deleted_objects(deleted_objects  
    446447                    nh(deleted_objects, current_depth, ['%s: %s' % (capfirst(related.opts.verbose_name), escape(str(sub_obj))), []])
    447448                else:
    448449                    # Display a link to the admin page.
    449                     nh(deleted_objects, current_depth, ['%s: <a href="../../../../%s/%s/%s/">%s</a>' % \
    450                         (capfirst(related.opts.verbose_name), related.opts.app_label, related.opts.object_name.lower(), sub_obj._get_pk_val(), escape(str(sub_obj))), []])
     450                    nh(deleted_objects, current_depth, [mark_safe('%s: <a href="../../../../%s/%s/%s/">%s</a>' % \
     451                        (escape(capfirst(related.opts.verbose_name)), related.opts.app_label, related.opts.object_name.lower(), sub_obj._get_pk_val(), escape(str(sub_obj)))), []])
    451452                _get_deleted_objects(deleted_objects, perms_needed, user, sub_obj, related.opts, current_depth+2)
    452453            # If there were related objects, and the user doesn't have
    453454            # permission to delete them, add the missing perm to perms_needed.
    … … def _get_deleted_objects(deleted_objects  
    475476                else:
    476477                    # Display a link to the admin page.
    477478                    nh(deleted_objects, current_depth, [
    478                         (_('One or more %(fieldname)s in %(name)s:') % {'fieldname': related.field.verbose_name, 'name':related.opts.verbose_name}) + \
     479                        mark_safe((_('One or more %(fieldname)s in %(name)s:') % {'fieldname': escape(related.field.verbose_name), 'name':related.opts.verbose_name}) + \
    479480                        (' <a href="../../../../%s/%s/%s/">%s</a>' % \
    480                             (related.opts.app_label, related.opts.module_name, sub_obj._get_pk_val(), escape(str(sub_obj)))), []])
     481                            (related.opts.app_label, related.opts.module_name, sub_obj._get_pk_val(), escape(str(sub_obj))))), []])
    481482        # If there were related objects, and the user doesn't have
    482483        # permission to change them, add the missing perm to perms_needed.
    483484        if related.opts.admin and has_related_objs:
    … … def delete_stage(request, app_label, mod  
    498499
    499500    # Populate deleted_objects, a data structure of all related objects that
    500501    # will also be deleted.
    501     deleted_objects = ['%s: <a href="../../%s/">%s</a>' % (capfirst(opts.verbose_name), object_id, escape(str(obj))), []]
     502    deleted_objects = [mark_safe('%s: <a href="../../%s/">%s</a>' %
     503        (escape(capfirst(opts.verbose_name)), object_id, escape(str(obj)))), []]
    502504    perms_needed = sets.Set()
    503505    _get_deleted_objects(deleted_objects, perms_needed, request.user, obj, opts, 1)
    504506
    … … class ChangeList(object):  
    595597                del p[k]
    596598            elif v is not None:
    597599                p[k] = v
    598         return '?' + '&amp;'.join(['%s=%s' % (k, v) for k, v in p.items()]).replace(' ', '%20')
     600        return mark_safe('?' + '&amp;'.join(['%s=%s' % (k, v) for k, v in p.items()]).replace(' ', '%20'))
    599601
    600602    def get_results(self, request):
    601603        paginator = ObjectPaginator(self.query_set, self.lookup_opts.admin.list_per_page)
Back to Top