Re: XSS and string interpolation

2012-06-28 Thread Alex Ogier
On Thu, Jun 28, 2012 at 1:14 PM, Luke Plant wrote: > > Some other alternatives: build_html, build_html_safe, format_html > +1 for format_html. Best, Alex Ogier -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send e

Question about DecimalFields and admin widgets.

2012-06-28 Thread Serge G. Spaolonzi
Hi, I wonder why does't the DecimalFields implement an Admin Widget like the other Fields?. I am working in a application based in the Admin site and I am in trouble trying to add some style to the decimal fields because they are rendered like a plain input text field with no class associated. F

Re: XSS and string interpolation

2012-06-28 Thread Luke Plant
On 28/06/12 16:32, Alex Ogier wrote: > That's an HTML-safe replacement of the str.format() method, so far as > I can tell (except that all parameters must be [safe-]strings). That > allows more idiomatic python, and won't require awkward shims in > python 3, but it would mean that you can't direct

Re: XSS and string interpolation

2012-06-28 Thread Alex Ogier
On Thu, Jun 28, 2012 at 11:18 AM, Alex Ogier wrote: > > Also, to be compatible with python 3 and more idiomatic python, I > would implement the function as: > >    def html_mark_safe(format_string, *args): >        return mark_safe(format_string.format(*map(conditional_escape, args))) > Actually,

Re: XSS and string interpolation

2012-06-28 Thread Alex Ogier
On Thu, Jun 28, 2012 at 10:52 AM, Jeremy Dunck wrote: > > On Jun 28, 2012, at 6:57 AM, Luke Plant wrote: > > > Hi all, > > > > 2) Any better name than 'html_fragment'? > > > > I like the general approach, but I miss the security-minded namse of > "escape" and "mark safe".   Maybe "safe_html_fragm

Re: XSS and string interpolation

2012-06-28 Thread Jeremy Dunck
On Jun 28, 2012, at 6:57 AM, Luke Plant wrote: > Hi all, > > 2) Any better name than 'html_fragment'? > I like the general approach, but I miss the security-minded namse of "escape" and "mark safe". Maybe "safe_html_fragment" or "make_safe_html_fragment"? Getting annoyingly long, I know.

Re: Customizable Serialization check-in

2012-06-28 Thread Piotr Grabowski
W dniu 26.06.2012 11:52, Tom Christie pisze: > It is the way I am doing deserialization - pass instance to subfields Seems fine. It's worth keeping in mind that there's two ways around of doing this. 1. Create an empty instance first, then populate it with the field values in turn. 2. Popul

XSS and string interpolation

2012-06-28 Thread Luke Plant
Hi all, Django's code base has quite a few instances of string interpolation being used to build up HTML e.g.: contrib/admin/util.py return mark_safe('%s: %s' % (escape(capfirst(opts.verbose_name)), admin_url,

Re: Newline stripping in templates: the dnl way

2012-06-28 Thread Stephen Kelly
Leon Matthews wrote: > On 2 March 2012 09:45, Carl Meyer > wrote: >> Same reason any ticket stalls - it seems that nobody felt strongly >> enough about it to put the time into reviewing and thoroughly testing >> the patch and marking it Ready for Checkin. If you'd like to see it in >> (post 1.4 a