Newforms-admin escapes html tags when allow_tags is set

[michelts@…]

Newforms-admin apply autoescape to a function output even when this function has the "allow_tags" attribute defined. There must be a way to output escape aware content from functions to the admin interface in order to output html content.

[Chris Beaven]

You can probably achieve outputting html by just using mark_safe(). Perhaps the documentation needs to be updated to remove the allow_tags reference?

[Michel Sabchuk]

No I can´t :) See above:

from django.db import models
from django.utils.safestring import mark_safe
from django.contrib import admin

class Example(models.Model):
    name = models.CharField()
    def test(self):
        return mark_safe('<b>%s</b>' % (self.name))

class ExampleOptions(admin.ModelAdmin):
    list_display = ('name', 'test')

admin_site = admin.AdminSite()
admin_site.register(Example, ExampleOptions)

This should output the name in bold weight but this is not true for now. But I agree with you, allow_tags should not be available in favor of mark_safe or some SafeData subclass ;)

[Michel Sabchuk]

I found my mistake, I need to set the "allow_tags" attribute even if I return a safe string. See above:

class Example(models.Model):
    name = models.CharField()
    def test(self):
        return mark_safe('<b>%s</b>' % (self.name))
    test.allow_tags = True

Maybe we should remove the allow_tags attribute?

[Jeffrey Gelens]

patch

[Jeffrey Gelens]

Created a patch so that mark_safe doesn't have to be used explicitly. This is conform the current documentation. This bug is already fixed in the trunk, but wasn't in the newforms-admin branch.

[Brian Rosner]

I was messing around with merging branches and noticed that trunk does this, but newforms-admin does not.

[Brian Rosner]

Ugh, the post commit hook is not closing tickets. This was fixed in [7394].