Ticket #615: admin.patch

django/views/admin/main.py

@@ -5 +5 @@
 from django.core.extensions import DjangoContext as Context
 from django.core.extensions import get_object_or_404, render_to_response
 from django.models.auth import log
-from django.utils.html import strip_tags
+from django.utils.html import escape
 from django.utils.httpwrappers import HttpResponse, HttpResponseRedirect
 from django.utils.text import capfirst, get_text_list
 from django.conf.settings import ADMIN_MEDIA_PREFIX
@@ -383 +383 @@
                     # For non-field list_display values, the value is a method
                     # name. Execute the method.
                     try:
-                        result_repr = strip_tags(str(getattr(result, field_name)()))
+                        result_repr = escape(str(getattr(result, field_name)()))
                     except ObjectDoesNotExist:
                         result_repr = EMPTY_CHANGELIST_VALUE
                 else:
@@ -392 +392 @@
                     # related object.
                     if isinstance(f.rel, meta.ManyToOne):
                         if field_val is not None:
-                            result_repr = getattr(result, 'get_%s' % f.name)()
+                            result_repr = escape(getattr(result, 'get_%s' % f.name)())
                         else:
                             result_repr = EMPTY_CHANGELIST_VALUE
                     # Dates are special: They're formatted in a certain way.
@@ -422 +422 @@
                     # Fields with choices are special: Use the representation
                     # of the choice.
                     elif f.choices:
-                        result_repr = dict(f.choices).get(field_val, EMPTY_CHANGELIST_VALUE)
+                        result_repr = escape(dict(f.choices).get(field_val, EMPTY_CHANGELIST_VALUE))
                     else:
-                        result_repr = strip_tags(str(field_val))
+                        result_repr = escape(str(field_val))
                 # Some browsers don't like empty "<td></td>"s.
                 if result_repr == '':
                     result_repr = '&nbsp;'
@@ -1024 +1024 @@
                 if rel_field.rel.edit_inline or not rel_opts.admin:
                     # Don't display link to edit, because it either has no
                     # admin or is edited inline.
-                    nh(deleted_objects, current_depth, ['%s: %s' % (capfirst(rel_opts.verbose_name), strip_tags(repr(sub_obj))), []])
+                    nh(deleted_objects, current_depth, ['%s: %s' % (capfirst(rel_opts.verbose_name), escape(repr(sub_obj))), []])
                 else:
                     # Display a link to the admin page.
                     nh(deleted_objects, current_depth, ['%s: <a href="../../../../%s/%s/%s/">%s</a>' % \
-                        (capfirst(rel_opts.verbose_name), rel_opts.app_label, rel_opts.module_name, sub_obj.id, strip_tags(repr(sub_obj))), []])
+                        (capfirst(rel_opts.verbose_name), rel_opts.app_label, rel_opts.module_name, sub_obj.id, escape(repr(sub_obj))), []])
                 _get_deleted_objects(deleted_objects, perms_needed, user, sub_obj, rel_opts, current_depth+2)
             # If there were related objects, and the user doesn't have
             # permission to delete them, add the missing perm to perms_needed.
@@ -1048 +1048 @@
                 # Don't display link to edit, because it either has no
                 # admin or is edited inline.
                 nh(deleted_objects, current_depth, ['One or more %s in %s: %s' % \
-                    (rel_field.name, rel_opts.verbose_name, strip_tags(repr(sub_obj))), []])
+                    (rel_field.name, rel_opts.verbose_name, escape(repr(sub_obj))), []])
             else:
                 # Display a link to the admin page.
                 nh(deleted_objects, current_depth, ['One or more %s in %s: <a href="../../../../%s/%s/%s/">%s</a>' % \
-                    (rel_field.name, rel_opts.verbose_name, rel_opts.app_label, rel_opts.module_name, sub_obj.id, strip_tags(repr(sub_obj))), []])
+                    (rel_field.name, rel_opts.verbose_name, rel_opts.app_label, rel_opts.module_name, sub_obj.id, escape(repr(sub_obj))), []])
         # If there were related objects, and the user doesn't have
         # permission to change them, add the missing perm to perms_needed.
         if rel_opts.admin and has_related_objs:
@@ -1069 +1069 @@
 
     # Populate deleted_objects, a data structure of all related objects that
     # will also be deleted.
-    deleted_objects = ['%s: <a href="../../%s/">%s</a>' % (capfirst(opts.verbose_name), object_id, strip_tags(repr(obj))), []]
+    deleted_objects = ['%s: <a href="../../%s/">%s</a>' % (capfirst(opts.verbose_name), object_id, escape(repr(obj))), []]
     perms_needed = sets.Set()
     _get_deleted_objects(deleted_objects, perms_needed, request.user, obj, opts, 1)