Opened 9 years ago

Closed 9 years ago

#2346 closed defect (fixed)

[patch] admin's base.html template needs to escape {{ title }}

Reported by: Gary Wilson <gary.wilson@…> Owned by: adrian
Component: contrib.admin Version:
Severity: major Keywords:
Cc: Triage Stage: Unreviewed
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

The admin's views.main.history view sets the "title" template tag to the string representation of the object, which can contain html.

Attachments (1)

base.html.diff (733 bytes) - added by Gary Wilson <gary.wilson@…> 9 years ago.

Download all attachments as: .zip

Change History (4)

Changed 9 years ago by Gary Wilson <gary.wilson@…>

comment:1 Changed 9 years ago by ubernostrum

One of these days someone will just do a global search and replace in the admin, turning }} into |escape }}.

comment:2 Changed 9 years ago by SmileyChris

Won't it be good when we have autoescaping templates ;)

comment:3 Changed 9 years ago by mtredinnick

  • Resolution set to fixed
  • Status changed from new to closed

(In [3342]) Fixed #2346 -- Escaped string output in titles in admin interface. Thanks Gary
Wilson.

Note: See TracTickets for help on using tickets.
Back to Top