Opened 8 years ago

Closed 7 years ago

#11502 closed (fixed)

Wrong escaping in admin

Reported by: Tomasz Elendt <tomasz.elendt@…> Owned by: nobody
Component: contrib.admin Version: master
Severity: Keywords:
Cc: tomasz.elendt@…, rlaager@… Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:


There are some places (I found two of them) in Django's admin where querystrings used in templates are marked as safe, which prevents them from auto-escaping. In effect there's unescaped ampersand, when there's more than one variable in querystring. It's hard for me to instruct how to reproduce this bug - IMHO the easiest way is to set your DEFAULT_CONTENT_TYPE to 'application/xhtml+xml' and click through the change list page of the admin (date_hierarchy menu, paginator).

There are also some formatting issues (e.g. some very long lines) in

Attachments (3)

admin_querysting_escaping.diff (1.2 KB) - added by anonymous 8 years ago.
admin_escaping.diff (2.1 KB) - added by Tomasz Elendt <tomasz.elendt@…> 7 years ago.
Pulled changes from #11583
django_escaping.diff (1.6 KB) - added by Tomasz Elendt <tomasz.elendt@…> 7 years ago.
Updated patch

Download all attachments as: .zip

Change History (7)

Changed 8 years ago by anonymous

Changed 7 years ago by Tomasz Elendt <tomasz.elendt@…>

Attachment: admin_escaping.diff added

Pulled changes from #11583

comment:1 Changed 7 years ago by anonymous

Cc: rlaager@… added

comment:2 Changed 7 years ago by Alex Gaynor

Triage Stage: UnreviewedAccepted

comment:3 Changed 7 years ago by Tomasz Elendt <tomasz.elendt@…>

One of the fixes in this patch has been pushed into trunk in r11486 (Ticket #11252). Attached patch need to be changed so that could be aplied on trunk in current state.

Changed 7 years ago by Tomasz Elendt <tomasz.elendt@…>

Attachment: django_escaping.diff added

Updated patch

comment:4 Changed 7 years ago by Luke Plant

Resolution: fixed
Status: newclosed

(In [11497]) Fixed #11502 - wrong escaping in admin.

Thanks Tomasz Elendt.

Note: See TracTickets for help on using tickets.
Back to Top