Ticket #6160: validation-escaping.5.diff

django/contrib/auth/tests/views.py

@@ -16 +16 @@
         response = self.client.get('/password_reset/')
         self.assertEquals(response.status_code, 200)
         response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'})
-        self.assertContains(response, "That e-mail address doesn't have an associated user account")
+        self.assertContains(response, "That e-mail address doesn't have an associated user account")
         self.assertEquals(len(mail.outbox), 0)
 
     def test_email_found(self):
@@ -87 +87 @@
         response = self.client.post(path, {'new_password1': 'anewpassword',
                                            'new_password2':' x'})
         self.assertEquals(response.status_code, 200)
-        self.assert_("The two password fields didn't match" in response.content)
+        self.assert_("The two password fields didn't match" in response.content)
 
 
 class ChangePasswordTest(TestCase):
@@ -147 +147 @@
             }
         )
         self.assertEquals(response.status_code, 200)
-        self.assert_("The two password fields didn't match." in response.content)
+        self.assert_("The two password fields didn't match." in response.content)
 
     def test_password_change_succeeds(self):
         self.login()

django/forms/forms.py

@@ -5 +5 @@
 from copy import deepcopy
 
 from django.utils.datastructures import SortedDict
-from django.utils.html import escape
+from django.utils.html import escape, conditional_escape
 from django.utils.encoding import StrAndUnicode, smart_unicode, force_unicode
 from django.utils.safestring import mark_safe
 
@@ -134 +134 @@
         output, hidden_fields = [], []
         for name, field in self.fields.items():
             bf = BoundField(self, field, name)
-            bf_errors = self.error_class([escape(error) for error in bf.errors]) # Escape and cache in local variable.
+            bf_errors = self.error_class([conditional_escape(error) for error in bf.errors]) # Escape and cache in local variable.
             if bf.is_hidden:
                 if bf_errors:
                     top_errors.extend([u'(Hidden field %s) %s' % (name, force_unicode(e)) for e in bf_errors])

django/forms/util.py

@@ -39 +39 @@
     def as_ul(self):
         if not self: return u''
         return mark_safe(u'<ul class="errorlist">%s</ul>'
-                % ''.join([u'<li>%s</li>' % force_unicode(e) for e in self]))
+                % ''.join([u'<li>%s</li>' % conditional_escape(force_unicode(e)) for e in self]))
 
     def as_text(self):
         if not self: return u''

tests/regressiontests/forms/util.py

@@ -49 +49 @@
 # Can take a non-string.
 >>> print ValidationError(VeryBadError()).messages
 <ul class="errorlist"><li>A very bad error.</li></ul>
+
+# Can escape and conditional escape.
+
+>>> from django.utils.html import escape, conditional_escape
+>>> example = 'Example of link: <a href="http://www.example.com/">example</a>'
+
+>>> print ValidationError(example).messages
+<ul class="errorlist"><li>Example of link: &lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;</li></ul>
+>>> print ValidationError(escape(example)).messages
+<ul class="errorlist"><li>Example of link: &lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;</li></ul>
+>>> print ValidationError(conditional_escape(example)).messages
+<ul class="errorlist"><li>Example of link: &lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;</li></ul>
+>>> print ValidationError(mark_safe(example)).messages
+<ul class="errorlist"><li>Example of link: <a href="http://www.example.com/">example</a></li></ul>
+
+>>> print conditional_escape(unicode(ValidationError(example).messages))
+<ul class="errorlist"><li>Example of link: &lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;</li></ul>
+>>> print conditional_escape(unicode(ValidationError(escape(example)).messages))
+<ul class="errorlist"><li>Example of link: &lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;</li></ul>
+>>> print conditional_escape(unicode(ValidationError(conditional_escape(example)).messages))
+<ul class="errorlist"><li>Example of link: &lt;a href=&quot;http://www.example.com/&quot;&gt;example&lt;/a&gt;</li></ul>
+>>> print conditional_escape(unicode(ValidationError(mark_safe(example)).messages))
+<ul class="errorlist"><li>Example of link: <a href="http://www.example.com/">example</a></li></ul>
 """