Opened 8 years ago
Last modified 3 years ago
#25872 new New feature
Title attribute for related widget links lacks escaping (and breaks html) — at Version 1
| Reported by: | ILYA | Owned by: | nobody |
|---|---|---|---|
| Component: | Template system | Version: | dev |
| Severity: | Normal | Keywords: | |
| Cc: | hello@… | Triage Stage: | Accepted |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | yes |
| Easy pickings: | no | UI/UX: | no |
Description (last modified by )
This issue appears when using russian locale because corresponding translated text fragment contains quotes there. While english locale and many others does not.
The problem is that title attributes for links in this file:
https://github.com/django/django/blob/1.9/django/contrib/admin/templates/admin/related_widget_wrapper.html
are not escaped at all. So title attribute ends before it must do and so breaks html.
I suggest to wrap blocktrans blocks with {% filter force_escape %} (already done it on my local django conf and everything worked seamless). If it's the way to go, I can make PR.
This bug affects version 1.8 too.
Note:
See TracTickets
for help on using tickets.