Ticket #17596: safestring_in_admin_field_label.patch

tests/regressiontests/admin_util/tests.py

@@ -6 +6 @@
 from django.contrib import admin
 from django.contrib.admin.util import (display_for_field, label_for_field,
     lookup_field, NestedObjects)
+from django.contrib.admin import helpers
 from django.contrib.admin.views.main import EMPTY_CHANGELIST_VALUE
 from django.contrib.sites.models import Site
 from django.db import models, DEFAULT_DB_ALIAS
 from django.test import TestCase
 from django.utils import unittest
 from django.utils.formats import localize
+from django import forms
+from django.utils.html import mark_safe
 
 from .models import Article, Count, Event, Location
 
@@ -258 +261 @@
         self.assertTrue(
             unicode(log_entry).startswith('Deleted ')
         )
+
+    def test_safestring_in_field_label(self):
+        # safestring should not be escaped.
+        class MyForm(forms.Form):
+            text=forms.CharField(label=mark_safe('<i>text</i>')) 
+            cb=forms.BooleanField(label=mark_safe('<i>cb</i>'))
+        form=MyForm()
+        self.assertEqual(helpers.AdminField(form, 'text', is_first=False).label_tag(), 
+                         '<label for="id_text" class="required inline"><i>text</i>:</label>')
+        self.assertEqual(helpers.AdminField(form, 'cb', is_first=False).label_tag(), 
+                         '<label for="id_cb" class="vCheckboxLabel required inline"><i>cb</i></label>')
+
+        # normal strings needs to be escaped.
+        class MyForm(forms.Form):
+            text=forms.CharField(label='&text') 
+            cb=forms.BooleanField(label='&cb')
+        form=MyForm()
+        self.assertEqual(helpers.AdminField(form, 'text', is_first=False).label_tag(), 
+                         '<label for="id_text" class="required inline">&amp;text:</label>')
+        self.assertEqual(helpers.AdminField(form, 'cb', is_first=False).label_tag(), 
+                         '<label for="id_cb" class="vCheckboxLabel required inline">&amp;cb</label>')

django/forms/forms.py

@@ -167 +167 @@
                     # punctuation.
                     if self.label_suffix:
                         if label[-1] not in ':?.!':
-                            label += self.label_suffix
+                            label=mark_safe(label + self.label_suffix)
                     label = bf.label_tag(label) or ''
                 else:
                     label = ''
@@ -503 +503 @@
 
         If attrs are given, they're used as HTML attributes on the <label> tag.
         """
-        contents = contents or conditional_escape(self.label)
+        if contents is None:
+            contents=self.label
+        contents=conditional_escape(contents)
         widget = self.field.widget
         id_ = widget.attrs.get('id') or self.auto_id
         if id_:

django/contrib/admin/helpers.py

@@ -117 +117 @@
         classes = []
         if self.is_checkbox:
             classes.append(u'vCheckboxLabel')
-            contents = force_unicode(escape(self.field.label))
-        else:
-            contents = force_unicode(escape(self.field.label)) + u':'
+            contents = force_unicode(self.field.label) # conditional_escape() is called in field.label_tag()
+        else: 
+            contents = mark_safe(conditional_escape(force_unicode(self.field.label)) + u':')
         if self.field.field.required:
             classes.append(u'required')
         if not self.is_first: