Ticket #6160: validation-escaping.2.diff

File validation-escaping.2.diff, 8.0 KB (added by Petr Marhoun <petr.marhoun@…>, 16 years ago)
  • django/newforms/forms.py

    === modified file 'django/newforms/forms.py'
     
    55from copy import deepcopy
    66
    77from django.utils.datastructures import SortedDict
    8 from django.utils.html import escape
     8from django.utils.html import escape, conditional_escape
    99from django.utils.encoding import StrAndUnicode, smart_unicode, force_unicode
    1010from django.utils.safestring import mark_safe
    1111
     
    127127        output, hidden_fields = [], []
    128128        for name, field in self.fields.items():
    129129            bf = BoundField(self, field, name)
    130             bf_errors = self.error_class([escape(error) for error in bf.errors]) # Escape and cache in local variable.
     130            bf_errors = self.error_class([conditional_escape(error) for error in bf.errors]) # Escape and cache in local variable.
    131131            if bf.is_hidden:
    132132                if bf_errors:
    133133                    top_errors.extend([u'(Hidden field %s) %s' % (name, force_unicode(e)) for e in bf_errors])
  • django/newforms/util.py

    === modified file 'django/newforms/util.py'
     
    1 from django.utils.html import escape
     1from django.utils.html import conditional_escape
    22from django.utils.encoding import smart_unicode, StrAndUnicode, force_unicode
    3 from django.utils.functional import Promise
    43from django.utils.safestring import mark_safe
    54
    65def flatatt(attrs):
     
    109    XML-style pairs.  It is assumed that the keys do not need to be XML-escaped.
    1110    If the passed dictionary is empty, then return an empty string.
    1211    """
    13     return u''.join([u' %s="%s"' % (k, escape(v)) for k, v in attrs.items()])
     12    return mark_safe(u''.join([u' %s="%s"' % (k, conditional_escape(v)) for k, v in attrs.items()]))
    1413
    1514class ErrorDict(dict, StrAndUnicode):
    1615    """
     
    5655        a string) or a list of objects.
    5756        """
    5857        if isinstance(message, list):
    59             self.messages = ErrorList([smart_unicode(msg) for msg in message])
     58            self.messages = ErrorList([conditional_escape(smart_unicode(msg)) for msg in message])
    6059        else:
    61             message = smart_unicode(message)
     60            message = conditional_escape(smart_unicode(message))
    6261            self.messages = ErrorList([message])
    6362
    6463    def __str__(self):
  • tests/regressiontests/forms/localflavor/ch.py

    === modified file 'tests/regressiontests/forms/localflavor/ch.py'
     
    4141>>> f.clean('C1234567<1')
    4242Traceback (most recent call last):
    4343...
    44 ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567<0 or 1234567890 format.']
     44ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567&lt;0 or 1234567890 format.']
    4545>>> f.clean('2123456700')
    4646u'2123456700'
    4747>>> f.clean('2123456701')
    4848Traceback (most recent call last):
    4949...
    50 ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567<0 or 1234567890 format.']
     50ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567&lt;0 or 1234567890 format.']
    5151
    5252# CHStateSelect #############################################################
    5353
  • tests/regressiontests/forms/util.py

    === modified file 'tests/regressiontests/forms/util.py'
     
    77>>> from django.newforms.util import *
    88>>> from django.utils.translation import ugettext_lazy
    99
     10# Escaping.
     11>>> from django.utils.html import escape
     12>>> from django.utils.html import conditional_escape
     13>>> script = "$('#example').html('<a href=\"http://www.example.com/\">example</a>');"
     14
    1015###########
    1116# flatatt #
    1217###########
     
    1924>>> flatatt({})
    2025u''
    2126
     27# Escaping.
     28
     29>>> flatatt({'onclick': script})
     30u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     31>>> flatatt({'onclick': escape(script)})
     32u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     33>>> flatatt({'onclick': conditional_escape(script)})
     34u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     35
     36>>> conditional_escape(flatatt({'onclick': script}))
     37u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     38>>> conditional_escape(flatatt({'onclick': escape(script)}))
     39u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     40>>> conditional_escape(flatatt({'onclick': conditional_escape(script)}))
     41u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     42
    2243###################
    2344# ValidationError #
    2445###################
     
    4970# Can take a non-string.
    5071>>> print ValidationError(VeryBadError()).messages
    5172<ul class="errorlist"><li>A very bad error.</li></ul>
     73
     74# Escaping.
     75
     76>>> print ValidationError(script).messages
     77<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     78>>> print ValidationError(escape(script)).messages
     79<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     80>>> print ValidationError(conditional_escape(script)).messages
     81<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     82>>> print ErrorDict({'example': ValidationError(script).messages})
     83<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     84>>> print ErrorDict({'example': ValidationError(escape(script)).messages})
     85<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     86>>> print ErrorDict({'example': ValidationError(conditional_escape(script)).messages})
     87<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     88
     89>>> print conditional_escape(unicode(ValidationError(script).messages))
     90<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     91>>> print conditional_escape(unicode(ValidationError(escape(script)).messages))
     92<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     93>>> print conditional_escape(unicode(ValidationError(conditional_escape(script)).messages))
     94<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     95>>> print conditional_escape(unicode(ErrorDict({'example': ValidationError(script).messages})))
     96<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     97>>> print conditional_escape(unicode(ErrorDict({'example': ValidationError(escape(script)).messages})))
     98<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     99>>> print conditional_escape(unicode(ErrorDict({'example': ValidationError(conditional_escape(script)).messages})))
     100<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     101
    52102"""
Back to Top