#25872: Title attribute for related widget links lacks escaping (and breaks
html)
-------------------------------+--------------------------------------
Reporter: a1tus | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Changes (by a1tus):
* needs_better_patch: => 0
* needs_tests: => 0
* needs_docs: => 0
Old description:
> This issue appears when using russian locale because corresponding
> translated text fragment contains quotes there. While english locale and
> manu others does not.
>
> The problem is that title attributes for links in this file:
> https://github.com/django/django/blob/1.9/django/contrib/admin/templates/admin/related_widget_wrapper.html
> are not escaped at all. So title attribute ends before it must do and so
> breaks html.
>
> I suggest to wrap `blocktrans` blocks with `{% filter force_escape %}`
> (already done it on my local django conf and everything worked seamless).
> If it's the way to go, I can make PR.
>
> This bug affects version 1.8 too.
New description:
This issue appears when using russian locale because corresponding
translated text fragment contains quotes there. While english locale and
many others does not.
The problem is that title attributes for links in this file:
https://github.com/django/django/blob/1.9/django/contrib/admin/templates/admin/related_widget_wrapper.html
are not escaped at all. So title attribute ends before it must do and so
breaks html.
I suggest to wrap `blocktrans` blocks with `{% filter force_escape %}`
(already done it on my local django conf and everything worked seamless).
If it's the way to go, I can make PR.
This bug affects version 1.8 too.
--
--
Ticket URL: <https://code.djangoproject.com/ticket/25872#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/063.4c5708c43a6779bb7c7670448b136a47%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
