Ticket #6160: 00-validation-error-escape.diff

django/newforms/util.py

@@ -40 +40 @@
     def as_ul(self):
         if not self: return u''
         return mark_safe(u'<ul class="errorlist">%s</ul>'
-                % ''.join([u'<li>%s</li>' % force_unicode(e) for e in self]))
+                % ''.join([u'<li>%s</li>' % escape(force_unicode(e)) for e in self]))
 
     def as_text(self):
         if not self: return u''