Ticket #6058: 00-admin-autoescape.diff

django/contrib/admin/templates/admin/change_form.html

@@ -3 +3 @@
 
 {% block extrahead %}{{ block.super }}
 <script type="text/javascript" src="../../../jsi18n/"></script>
-{{ media }}
+{{ media|safe }}
 {% endblock %}
 
 {% block stylesheet %}{% admin_media_prefix %}css/forms.css{% endblock %}

django/contrib/admin/templates/admin/change_list_results.html

@@ -2 +2 @@
 <table cellspacing="0">
 <thead>
 <tr>
-{% for header in result_headers %}<th{{ header.class_attrib }}>
+{% for header in result_headers %}<th{{ header.class_attrib|safe }}>
 {% if header.sortable %}<a href="{{ header.url }}">{% endif %}
 {{ header.text|capfirst }}
 {% if header.sortable %}</a>{% endif %}</th>{% endfor %}

django/contrib/admin/templates/admin/includes/fieldset.html

@@ -3 +3 @@
   {% if fieldset.description %}<div class="description">{{ fieldset.description }}</div>{% endif %}
   {% for line in fieldset %}
       <div class="form-row{% if line.errors %} errors{% endif %} {% for field in line %}{{ field.field.name }} {% endfor %} ">
-      {{ line.errors }}
+      {{ line.errors|safe }}
       {% for field in line %}
           {% if field.is_checkbox %}
               {{ field.field }}{{ field.label_tag }}

django/contrib/admin/views/main.py

@@ -9 +9 @@
 from django.db.models.query import handle_legacy_orderlist, QuerySet
 from django.http import Http404
 from django.utils.encoding import force_unicode, smart_str
+from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext
 import operator
 

django/contrib/admin/widgets.py

@@ -5 +5 @@
 from django import newforms as forms
 from django.utils.datastructures import MultiValueDict
 from django.utils.text import capfirst
+from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext as _
 from django.conf import settings
 
@@ -28 +29 @@
         # API to determine the ID dynamically.
         output.append(u'SelectFilter.init("id_%s", "%s", %s, "%s"); });</script>\n' % \
             (name, self.verbose_name.replace('"', '\\"'), int(self.is_stacked), settings.ADMIN_MEDIA_PREFIX))
-        return u''.join(output)
+        return mark_safe(u''.join(output))
 
 class AdminDateWidget(forms.TextInput):
     class Media:
@@ -73 +74 @@
         if value:
             output.append('Currently: <a target="_blank" href="%s%s">%s</a> <br>Change: ' % (settings.MEDIA_URL, value, value))
         output.append(super(AdminFileWidget, self).render(name, value, attrs))
-        return u''.join(output)
+        return mark_safe(u''.join(output))
 
 class ForeignKeyRawIdWidget(forms.TextInput):
     """
@@ -99 +100 @@
         output.append('<a href="%s%s" class="related-lookup" id="lookup_id_%s" onclick="return showRelatedObjectLookupPopup(this);"> ' % \
             (related_url, url, name))
         output.append('<img src="%simg/admin/selector-search.gif" width="16" height="16" alt="Lookup"></a>' % settings.ADMIN_MEDIA_PREFIX)
-        return u''.join(output)
+        return mark_safe(u''.join(output))
         #if self.change: # TODO
             #output.append('&nbsp;<strong>TODO</strong>')
             
@@ -148 +149 @@
             output.append(u'<a href="%sadd/" class="add-another" id="add_id_%s" onclick="return showAddAnotherPopup(this);"> ' % \
                 (related_url, name))
             output.append(u'<img src="%simg/admin/icon_addlink.gif" width="10" height="10" alt="Add Another"/></a>' % settings.ADMIN_MEDIA_PREFIX)
-        return u''.join(output)
+        return mark_safe(u''.join(output))
 
     def __deepcopy__(self, memo):
         # There's no reason to deepcopy admin_site, etc, so just return self.

django/newforms/widgets.py

@@ -528 +528 @@
             if id_:
                 final_attrs = dict(final_attrs, id='%s_%s' % (id_, i))
             output.append(widget.render(name + '_%s' % i, widget_value, final_attrs))
-        return self.format_output(output)
+        return mark_safe(self.format_output(output))
 
     def id_for_label(self, id_):
         # See the comment for RadioSelect.id_for_label()