password_validators_help_text_html isn't marked as safe correctly

[Ole Laursen]

Last lines say

    help_items = [format_html('<li>{}</li>', help_text) for help_text in help_texts]
    return '<ul>%s</ul>' % ''.join(help_items) if help_items else ''

So in the last line it's throwing away the safe text information put in by format_html in the previous line.

The result is that if you output the help_text of django.contrib.auth.forms.PasswordChangeForm in a template, the HTML bullets are escaped (user sees HTML code instead of bullets). For some reason, I don't see this problem within the admin site, which is actually a bit worrying.

This seems to work instead:

    formatted_help_items = format_html_join("", '<li>{}</li>', ((help_text,) for help_text in help_texts))
    return format_html("<ul>{}</ul>", formatted_help_items) if formatted_help_items else ""

[Tim Graham]

The bug doesn't manifest itself in the admin because those help_texts are marked as safe in the template (#25053).

[Alvin Lindstam]

​PR

Hope it's OK that I reassigned it, there's not been any activity for a month.

[Tim Graham <timograham@…>]

In 2cb6b773:

Fixed #28902 -- Fixed password_validators_help_text_html() double escaping.