Deprecate admin list_display allow_tags

[Jaap Roes]

I've noticed that setting allow_tags on a list_display function is not necessary if it already returns a safe string (by using mark_safe or format_html).

The docs on allow_tags mention:

If the string given is a method of the model, ModelAdmin or a callable, Django will HTML-escape the output by default. If you’d rather not escape the output of the method, give the method an allow_tags attribute whose value is True. However, to avoid an XSS vulnerability, you should use format_html() to escape user-provided inputs.

To push people to actually do that, deprecating allow_tags and pointing to format_html/mark_safe could be a good thing.

[Tim Graham]

Looking at the code, I think it could be a bit tricky, but the idea sounds good.

[Jaap Roes]

Created a pull request with my initial attempt. Django tests all pass, but it might just be that allow_tags is not tested that well.

Having a hard time figuring out where to add tests though...

[Tim Graham]

Waiting on one more test as noted on the pull request.

[Tim Graham]

Pending some cosmetic tweaks.

[Tim Graham <timograham@…>]

In f2f8972:

Fixed #25135 -- Deprecated the contrib.admin allow_tags attribute.

Thanks Jaap Roes for the idea and initial patch.

[Jaap Roes]

Thank you olasitarska for fixing this up!

[Tim Graham <timograham@…>]

In 00adec6:

Refs #25135 -- Corrected the timeline section of allow_tags deprecation.

[Tim Graham <timograham@…>]

In d67a46e1:

Refs #25135 -- Removed support for the contrib.admin allow_tags attribute.

Per deprecation timeline.