An html snippet like the following:
<a onclick="f('he\'s')" ...
is legal and is what this template would produce with autoescaping if str =
he's:
<a onclick="f('{ str|escapejs }')" ...
However, if force_escape is called first (or the string was escaped through
some other method):
<a onclick="f('{ str|force_escape|escapejs }')" ...
we don't get the right result (escapejs didn't escape string):
<a onclick="f('he's')" ...
I am not sure whether or not this is a bug. I have attached a patch that
could be used if this is considered a bug, but I have mixed feelings about
it because it makes escapejs potentially misbehave if it is called in a
template for a .js file rather than in an html context.
Should I file a ticket for this?
Craig
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Django developers" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/django-developers?hl=en
-~----------~----~----~----~------~----~------~--~---
escapejs.diff
Description: Binary data
