id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
14976	Add is_html flag to contrib.messages	Ted	nobody	"I would like to have add a message.is_html flag to the Message model of the contrib.messages app.

The flag would be set to False by default and could be explicitly overridden for messages that are HTML.  There are times when it would be helpful to the end user to include an html link in a message (""Welcome, click here to create a profile"", ""You've sent 25 points to user_b, click here to see your balance,"" etc.), and with the current message system there is not a good way to do this.

Adding the is_html flag would require a minor set of backward compatible changes:

{{{
def success(request, message, extra_tags='', fail_silently=False):
to
def success(request, message, extra_tags='', fail_silently=False, is_html=False):

def add_message(request, level, message, extra_tags='', fail_silently=False):
to 
def add_message(request, level, message, extra_tags='', fail_silently=False, is_html=False):

def __init__(self, level, message, extra_tags=None): 
to
def __init__(self, level, message, extra_tags=None, is_html=False):

#add to __init__
self.is_html = is_html
}}}

Then in the template: 
{{{
{% if message.is_html %}{{ message|safe }}{% else %}{{ message }}{% endif %}.
}}}
  

Alternative ways to do this:


 1. Run all messages through the safe filter[[BR]][[BR]]
 This would require a code-wide policy of ""make sure you escape anything in a message that might have user input"" such as if my message is ""your post %s is now published"" % blog.post or ""%s has sent you the message %s"" %(user, message.content).   I would then have to worry about every variable I use in a message string, if it could contain script, and if it is already escaped (or escape everything again).  I would also have to worry if everyone else working on the codebase is doing this correctly.

 2. Use a tag[[BR]][[BR]]
 I could have a policy of adding ""html"" to the tags I want to run through the safe filter, but this is also fraught with downsides.  Since all tags get output into html, the safe flag would end up output to the end user.  The template logic is less clear and error prone.

If this isn't violating a core django design precept, I'll get started on a patch in the next few days.
"	New feature	closed	contrib.messages	dev	Normal	fixed	safe, messages, html	florian+django@…	Accepted	1	1	1	0	0	0