Ticket #2359: unicode-autoescape-2.diff

File unicode-autoescape-2.diff, 11.2 KB (added by mir@…, 17 years ago)

contrib changes ported for the unicode branch

  • django/contrib/csrf/middleware.py

    a b against request forgeries from other sit  
    77"""
    88from django.conf import settings
    99from django.http import HttpResponseForbidden
     10from django.utils.safestring import mark_safe
    1011import md5
    1112import re
    1213import itertools
    1314
    14 _ERROR_MSG = '<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>'
     15_ERROR_MSG = mark_safe('<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>')
    1516
    1617_POST_FORM_RE = \
    1718    re.compile(r'(<form\W[^>]*\bmethod=(\'|"|)POST(\'|"|)\b[^>]*>)', re.IGNORECASE)
    … … class CsrfMiddleware(object):  
    8283                                            itertools.repeat(''))
    8384            def add_csrf_field(match):
    8485                """Returns the matched <form> tag plus the added <input> element"""
    85                 return match.group() + "<div style='display:none;'>" + \
     86                return mark_safe(match.group() + "<div style='display:none;'>" + \
    8687                "<input type='hidden' " + idattributes.next() + \
    8788                " name='csrfmiddlewaretoken' value='" + csrf_token + \
    88                 "' /></div>"
     89                "' /></div>")
    8990
    9091            # Modify any POST forms
    9192            response.content = _POST_FORM_RE.sub(add_csrf_field, response.content)

  • django/contrib/humanize/templatetags/humanize.py 

    diff --git a/django/contrib/humanize/templatetags/humanize.py b/django/contrib/humanize/templatetags/humanize.py
index 699d9300b8ea478e82ec21da8913ecea4eaaf40b..5de2230249d54f36b911913d61897f2bbbdb0714 100644
    a b  
    1 from django.utils.translation import ungettext, ugettext as _
     1from django.utils.translation import ungettext, ugettext_lazy as _
    22from django.utils.encoding import force_unicode
    33from django import template
    44import re
    … … def ordinal(value):  
    1818    if value % 100 in (11, 12, 13): # special case
    1919        return u"%d%s" % (value, t[0])
    2020    return u'%d%s' % (value, t[value % 10])
     21ordinal.is_safe = True
    2122register.filter(ordinal)
    2223
    2324def intcomma(value):
    … … def intcomma(value):  
    3132        return new
    3233    else:
    3334        return intcomma(new)
     35intcomma.is_safe = True
    3436register.filter(intcomma)
    3537
    3638def intword(value):
    … … def intword(value):  
    5254        new_value = value / 1000000000000.0
    5355        return ungettext('%(value).1f trillion', '%(value).1f trillion', new_value) % {'value': new_value}
    5456    return value
     57intword.is_safe = False
    5558register.filter(intword)
    5659
    5760def apnumber(value):
    … … def apnumber(value):  
    6669    if not 0 < value < 10:
    6770        return value
    6871    return (_('one'), _('two'), _('three'), _('four'), _('five'), _('six'), _('seven'), _('eight'), _('nine'))[value-1]
     72apnumber.is_safe = True
    6973register.filter(apnumber)

  • django/contrib/markup/templatetags/markup.py 

    diff --git a/django/contrib/markup/templatetags/markup.py b/django/contrib/markup/templatetags/markup.py
index 5d1f0ff1fb26564702822e57dc56f01970ae32b6..13708fd26df27cec10c45672f9cb9a6f15e7caf1 100644
    a b silently fail and return the un-marked-u  
    1717from django import template
    1818from django.conf import settings
    1919from django.utils.encoding import smart_str, force_unicode
     20from django.utils.safestring import mark_safe
    2021
    2122register = template.Library()
    2223
    … … def textile(value):  
    2829            raise template.TemplateSyntaxError, "Error in {% textile %} filter: The Python textile library isn't installed."
    2930        return force_unicode(value)
    3031    else:
    31         return force_unicode(textile.textile(smart_str(value), encoding='utf-8', output='utf-8'))
     32        return mark_safe(force_unicode(textile.textile(smart_str(value), encoding='utf-8', output='utf-8')))
     33textile.is_safe = True
    3234
    3335def markdown(value):
    3436    try:
    … … def markdown(value):  
    3840            raise template.TemplateSyntaxError, "Error in {% markdown %} filter: The Python markdown library isn't installed."
    3941        return force_unicode(value)
    4042    else:
    41         return force_unicode(markdown.markdown(smart_str(value)))
     43        return mark_safe(force_unicode(markdown.markdown(smart_str(value))))
     44markdown.is_safe = True
    4245
    4346def restructuredtext(value):
    4447    try:
    … … def restructuredtext(value):  
    5053    else:
    5154        docutils_settings = getattr(settings, "RESTRUCTUREDTEXT_FILTER_SETTINGS", {})
    5255        parts = publish_parts(source=smart_str(value), writer_name="html4css1", settings_overrides=docutils_settings)
    53         return force_unicode(parts["fragment"])
     56        return mark_safe(force_unicode(parts["fragment"]))
     57restructuredtext.is_safe = True
    5458
    5559register.filter(textile)
    5660register.filter(markdown)

  • django/views/debug.py 

    diff --git a/django/views/debug.py b/django/views/debug.py
index 07a9fd9ceea17db506108468b738040ad50ff31c..53abd97556e438c882988f121527a231704ec6c3 100644
    a b TECHNICAL_500_TEMPLATE = """  
    321321  </script>
    322322</head>
    323323<body>
    324 
     324{% autoescape %}
    325325<div id="summary">
    326326  <h1>{{ exception_type }} at {{ request.path|escape }}</h1>
    327327  <h2>{{ exception_value|escape }}</h2>
    … … TECHNICAL_500_TEMPLATE = """  
    369369<div id="template">
    370370   <h2>Template error</h2>
    371371   <p>In template <code>{{ template_info.name }}</code>, error at line <strong>{{ template_info.line }}</strong></p>
    372    <h3>{{ template_info.message|escape }}</h3>
     372   <h3>{{ template_info.message }}</h3>
    373373   <table class="source{% if template_info.top %} cut-top{% endif %}{% ifnotequal template_info.bottom template_info.total %} cut-bottom{% endifnotequal %}">
    374374   {% for source_line in template_info.source_lines %}
    375375   {% ifequal source_line.0 template_info.line %}
    … … TECHNICAL_500_TEMPLATE = """  
    396396          {% if frame.context_line %}
    397397            <div class="context" id="c{{ frame.id }}">
    398398              {% if frame.pre_context %}
    399                 <ol start="{{ frame.pre_context_lineno }}" class="pre-context" id="pre{{ frame.id }}">{% for line in frame.pre_context %}<li onclick="toggle('pre{{ frame.id }}', 'post{{ frame.id }}')">{{ line|escape }}</li>{% endfor %}</ol>
     399                <ol start="{{ frame.pre_context_lineno }}" class="pre-context" id="pre{{ frame.id }}">{% for line in frame.pre_context %}<li onclick="toggle('pre{{ frame.id }}', 'post{{ frame.id }}')">{{ line }}</li>{% endfor %}</ol>
    400400              {% endif %}
    401               <ol start="{{ frame.lineno }}" class="context-line"><li onclick="toggle('pre{{ frame.id }}', 'post{{ frame.id }}')">{{ frame.context_line|escape }} <span>...</span></li></ol>
     401              <ol start="{{ frame.lineno }}" class="context-line"><li onclick="toggle('pre{{ frame.id }}', 'post{{ frame.id }}')">{{ frame.context_line }} <span>...</span></li></ol>
    402402              {% if frame.post_context %}
    403                 <ol start='{{ frame.lineno|add:"1" }}' class="post-context" id="post{{ frame.id }}">{% for line in frame.post_context %}<li onclick="toggle('pre{{ frame.id }}', 'post{{ frame.id }}')">{{ line|escape }}</li>{% endfor %}</ol>
     403                <ol start='{{ frame.lineno|add:"1" }}' class="post-context" id="post{{ frame.id }}">{% for line in frame.post_context %}<li onclick="toggle('pre{{ frame.id }}', 'post{{ frame.id }}')">{{ line }}</li>{% endfor %}</ol>
    404404              {% endif %}
    405405            </div>
    406406          {% endif %}
    … … TECHNICAL_500_TEMPLATE = """  
    420420                {% for var in frame.vars|dictsort:"0" %}
    421421                  <tr>
    422422                    <td>{{ var.0 }}</td>
    423                     <td class="code"><div>{{ var.1|pprint|escape }}</div></td>
     423                    <td class="code"><div>{{ var.1|pprint }}</div></td>
    424424                  </tr>
    425425                {% endfor %}
    426426              </tbody>
    … … Traceback (most recent call last):<br/>  
    440440{% for frame in frames %}
    441441  File "{{ frame.filename }}" in {{ frame.function }}<br/>
    442442  {% if frame.context_line %}
    443     &nbsp;&nbsp;{{ frame.lineno }}. {{ frame.context_line|escape }}<br/>
     443    &nbsp;&nbsp;{{ frame.lineno }}. {{ frame.context_line }}<br/>
    444444  {% endif %}
    445445{% endfor %}<br/>
    446446&nbsp;&nbsp;{{ exception_type }} at {{ request.path|escape }}<br/>
    … … Traceback (most recent call last):<br/>  
    468468        {% for var in request.GET.items %}
    469469          <tr>
    470470            <td>{{ var.0 }}</td>
    471             <td class="code"><div>{{ var.1|pprint|escape }}</div></td>
     471            <td class="code"><div>{{ var.1|pprint }}</div></td>
    472472          </tr>
    473473        {% endfor %}
    474474      </tbody>
    … … Traceback (most recent call last):<br/>  
    490490        {% for var in request.POST.items %}
    491491          <tr>
    492492            <td>{{ var.0 }}</td>
    493             <td class="code"><div>{{ var.1|pprint|escape }}</div></td>
     493            <td class="code"><div>{{ var.1|pprint }}</div></td>
    494494          </tr>
    495495        {% endfor %}
    496496      </tbody>
    … … Traceback (most recent call last):<br/>  
    512512        {% for var in request.COOKIES.items %}
    513513          <tr>
    514514            <td>{{ var.0 }}</td>
    515             <td class="code"><div>{{ var.1|pprint|escape }}</div></td>
     515            <td class="code"><div>{{ var.1|pprint }}</div></td>
    516516          </tr>
    517517        {% endfor %}
    518518      </tbody>
    … … Traceback (most recent call last):<br/>  
    533533      {% for var in request.META.items|dictsort:"0" %}
    534534        <tr>
    535535          <td>{{ var.0 }}</td>
    536           <td class="code"><div>{{ var.1|pprint|escape }}</div></td>
     536          <td class="code"><div>{{ var.1|pprint }}</div></td>
    537537        </tr>
    538538      {% endfor %}
    539539    </tbody>
    … … Traceback (most recent call last):<br/>  
    552552      {% for var in settings.items|dictsort:"0" %}
    553553        <tr>
    554554          <td>{{ var.0 }}</td>
    555           <td class="code"><div>{{ var.1|pprint|escape }}</div></td>
     555          <td class="code"><div>{{ var.1|pprint }}</div></td>
    556556        </tr>
    557557      {% endfor %}
    558558    </tbody>
    … … Traceback (most recent call last):<br/>  
    567567    display a standard 500 page.
    568568  </p>
    569569</div>
    570 
     570{% endautoescape %}
    571571</body>
    572572</html>
    573573"""
    … … TECHNICAL_404_TEMPLATE = """  
    598598  </style>
    599599</head>
    600600<body>
     601{% autoescape %}
    601602  <div id="summary">
    602603    <h1>Page not found <span>(404)</span></h1>
    603604    <table class="meta">
    … … TECHNICAL_404_TEMPLATE = """  
    619620      </p>
    620621      <ol>
    621622        {% for pattern in urlpatterns %}
    622           <li>{{ pattern|escape }}</li>
     623          <li>{{ pattern }}</li>
    623624        {% endfor %}
    624625      </ol>
    625626      <p>The current URL, <code>{{ request_path|escape }}</code>, didn't match any of these.</p>
    626627    {% else %}
    627       <p>{{ reason|escape }}</p>
     628      <p>{{ reason }}</p>
    628629    {% endif %}
    629630  </div>
    630631
    … … TECHNICAL_404_TEMPLATE = """  
    635636      will display a standard 404 page.
    636637    </p>
    637638  </div>
     639{% endautoescape %}
    638640</body>
    639641</html>
    640642"""
    … … EMPTY_URLCONF_TEMPLATE = """  
    669671</head>
    670672
    671673<body>
     674{% autoescape %}
    672675<div id="summary">
    673676  <h1>It worked!</h1>
    674677  <h2>Congratulations on your first Django-powered page.</h2>
    … … EMPTY_URLCONF_TEMPLATE = """  
    688691    Django settings file and you haven't configured any URLs. Get to work!
    689692  </p>
    690693</div>
     694{% endautoescape %}
    691695</body></html>
    692696"""
Back to Top