Ticket #6160: validation-escaping.3.diff

File validation-escaping.3.diff, 9.2 KB (added by Petr Marhoun <petr.marhoun@…>, 16 years ago)

  • django/contrib/auth/tests/basic.py 

    === modified file 'django/contrib/auth/tests/basic.py'
     
    6767        response = self.client.get('/password_reset/')
    6868        self.assertEquals(response.status_code, 200)
    6969        response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'})
    70         self.assertContains(response, "That e-mail address doesn't have an associated user account")
     70        self.assertContains(response, "That e-mail address doesn&#39;t have an associated user account")
    7171        self.assertEquals(len(mail.outbox), 0)
    7272   
    7373    def test_email_found(self):

  • django/contrib/auth/tests/forms.py 

    === modified file 'django/contrib/auth/tests/forms.py'
     
    4242>>> form.is_valid()
    4343False
    4444>>> form["password2"].errors
    45 [u"The two password fields didn't match."]
     45[u'The two password fields didn&#39;t match.']
    4646
    4747The success case.
    4848
    … …  
    119119>>> form.is_valid()
    120120False
    121121>>> form["new_password2"].errors
    122 [u"The two password fields didn't match."]
     122[u'The two password fields didn&#39;t match.']
    123123
    124124The success case.
    125125

  • django/forms/forms.py 

    === modified file 'django/forms/forms.py'
     
    55from copy import deepcopy
    66
    77from django.utils.datastructures import SortedDict
    8 from django.utils.html import escape
     8from django.utils.html import escape, conditional_escape
    99from django.utils.encoding import StrAndUnicode, smart_unicode, force_unicode
    1010from django.utils.safestring import mark_safe
    1111
    … …  
    134134        output, hidden_fields = [], []
    135135        for name, field in self.fields.items():
    136136            bf = BoundField(self, field, name)
    137             bf_errors = self.error_class([escape(error) for error in bf.errors]) # Escape and cache in local variable.
     137            bf_errors = self.error_class([conditional_escape(error) for error in bf.errors]) # Escape and cache in local variable.
    138138            if bf.is_hidden:
    139139                if bf_errors:
    140140                    top_errors.extend([u'(Hidden field %s) %s' % (name, force_unicode(e)) for e in bf_errors])

  • django/forms/util.py 

    === modified file 'django/forms/util.py'
     
    1 from django.utils.html import escape
     1from django.utils.html import conditional_escape
    22from django.utils.encoding import smart_unicode, StrAndUnicode, force_unicode
    3 from django.utils.functional import Promise
    43from django.utils.safestring import mark_safe
    54
    65def flatatt(attrs):
    … …  
    109    XML-style pairs.  It is assumed that the keys do not need to be XML-escaped.
    1110    If the passed dictionary is empty, then return an empty string.
    1211    """
    13     return u''.join([u' %s="%s"' % (k, escape(v)) for k, v in attrs.items()])
     12    return mark_safe(u''.join([u' %s="%s"' % (k, conditional_escape(v)) for k, v in attrs.items()]))
    1413
    1514class ErrorDict(dict, StrAndUnicode):
    1615    """
    … …  
    5655        a string) or a list of objects.
    5756        """
    5857        if isinstance(message, list):
    59             self.messages = ErrorList([smart_unicode(msg) for msg in message])
     58            self.messages = ErrorList([conditional_escape(smart_unicode(msg)) for msg in message])
    6059        else:
    61             message = smart_unicode(message)
     60            message = conditional_escape(smart_unicode(message))
    6261            self.messages = ErrorList([message])
    6362
    6463    def __str__(self):

  • tests/regressiontests/forms/localflavor/ch.py 

    === modified file 'tests/regressiontests/forms/localflavor/ch.py'
     
    4141>>> f.clean('C1234567<1')
    4242Traceback (most recent call last):
    4343...
    44 ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567<0 or 1234567890 format.']
     44ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567&lt;0 or 1234567890 format.']
    4545>>> f.clean('2123456700')
    4646u'2123456700'
    4747>>> f.clean('2123456701')
    4848Traceback (most recent call last):
    4949...
    50 ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567<0 or 1234567890 format.']
     50ValidationError: [u'Enter a valid Swiss identity or passport card number in X1234567&lt;0 or 1234567890 format.']
    5151
    5252# CHStateSelect #############################################################
    5353

  • tests/regressiontests/forms/util.py 

    === modified file 'tests/regressiontests/forms/util.py'
     
    77>>> from django.forms.util import *
    88>>> from django.utils.translation import ugettext_lazy
    99
     10# Escaping.
     11>>> from django.utils.html import escape
     12>>> from django.utils.html import conditional_escape
     13>>> script = "$('#example').html('<a href=\"http://www.example.com/\">example</a>');"
     14
    1015###########
    1116# flatatt #
    1217###########
    … …  
    1924>>> flatatt({})
    2025u''
    2126
     27# Escaping.
     28
     29>>> flatatt({'onclick': script})
     30u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     31>>> flatatt({'onclick': escape(script)})
     32u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     33>>> flatatt({'onclick': conditional_escape(script)})
     34u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     35
     36>>> conditional_escape(flatatt({'onclick': script}))
     37u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     38>>> conditional_escape(flatatt({'onclick': escape(script)}))
     39u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     40>>> conditional_escape(flatatt({'onclick': conditional_escape(script)}))
     41u' onclick="$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);"'
     42
    2243###################
    2344# ValidationError #
    2445###################
    … …  
    4970# Can take a non-string.
    5071>>> print ValidationError(VeryBadError()).messages
    5172<ul class="errorlist"><li>A very bad error.</li></ul>
     73
     74# Escaping.
     75
     76>>> print ValidationError(script).messages
     77<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     78>>> print ValidationError(escape(script)).messages
     79<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     80>>> print ValidationError(conditional_escape(script)).messages
     81<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     82>>> print ErrorDict({'example': ValidationError(script).messages})
     83<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     84>>> print ErrorDict({'example': ValidationError(escape(script)).messages})
     85<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     86>>> print ErrorDict({'example': ValidationError(conditional_escape(script)).messages})
     87<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     88
     89>>> print conditional_escape(unicode(ValidationError(script).messages))
     90<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     91>>> print conditional_escape(unicode(ValidationError(escape(script)).messages))
     92<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     93>>> print conditional_escape(unicode(ValidationError(conditional_escape(script)).messages))
     94<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul>
     95>>> print conditional_escape(unicode(ErrorDict({'example': ValidationError(script).messages})))
     96<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     97>>> print conditional_escape(unicode(ErrorDict({'example': ValidationError(escape(script)).messages})))
     98<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     99>>> print conditional_escape(unicode(ErrorDict({'example': ValidationError(conditional_escape(script)).messages})))
     100<ul class="errorlist"><li>example<ul class="errorlist"><li>$(&#39;#example&#39;).html(&#39;&lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;&#39;);</li></ul></li></ul>
     101
    52102"""
Back to Top