Ticket #6058: autoescape-kmt.diff

django/newforms/widgets.py

@@ -528 +528 @@
             if id_:
                 final_attrs = dict(final_attrs, id='%s_%s' % (id_, i))
             output.append(widget.render(name + '_%s' % i, widget_value, final_attrs))
-        return self.format_output(output)
+        return mark_safe(self.format_output(output))
 
     def id_for_label(self, id_):
         # See the comment for RadioSelect.id_for_label()

django/contrib/admin/options.py

@@ -101 +101 @@
             yield AdminField(self.form, field, is_first=(i == 0))
 
     def errors(self):
-        return u'\n'.join([self.form[f].errors.as_ul() for f in self.fields])
+        return mark_safe(u'\n'.join([self.form[f].errors.as_ul() for f in self.fields]))
 
 class AdminField(object):
     def __init__(self, form, field, is_first):
@@ -522 +522 @@
             'adminform': adminForm,
             'is_popup': request.REQUEST.has_key('_popup'),
             'show_delete': False,
-            'media': media,
+            'media': mark_safe(media),
             'inline_admin_formsets': inline_admin_formsets,
         })
         return self.render_change_form(model, c, add=True)
@@ -597 +597 @@
             'object_id': object_id,
             'original': obj,
             'is_popup': request.REQUEST.has_key('_popup'),
-            'media': media,
+            'media': mark_safe(media),
             'inline_admin_formsets': inline_admin_formsets,
         })
         return self.render_change_form(model, c, change=True)

django/contrib/admin/templatetags/admin_list.py

@@ -114 +114 @@
         yield {"text": header,
                "sortable": True,
                "url": cl.get_query_string({ORDER_VAR: i, ORDER_TYPE_VAR: new_order_type}),
-               "class_attrib": (th_classes and ' class="%s"' % ' '.join(th_classes) or '')}
+               "class_attrib": mark_safe((th_classes and ' class="%s"' % ' '.join(th_classes) or ''))}
 
 def _boolean_icon(field_val):
     BOOLEAN_MAPPING = {True: 'yes', False: 'no', None: 'unknown'}

django/contrib/admin/views/main.py

@@ -10 +10 @@
 from django.http import Http404
 from django.utils.encoding import force_unicode, smart_str
 from django.utils.translation import ugettext
+from django.utils.safestring import mark_safe
 import operator
 
 try:

django/contrib/admin/widgets.py

@@ -7 +7 @@
 from django.utils.text import capfirst
 from django.utils.translation import ugettext as _
 from django.conf import settings
+from django.utils.safestring import mark_safe
 
 class FilteredSelectMultiple(forms.SelectMultiple):
     """
@@ -28 +29 @@
         # API to determine the ID dynamically.
         output.append(u'SelectFilter.init("id_%s", "%s", %s, "%s"); });</script>\n' % \
             (name, self.verbose_name.replace('"', '\\"'), int(self.is_stacked), settings.ADMIN_MEDIA_PREFIX))
-        return u''.join(output)
+        return mark_safe(''.join(output))
 
 class AdminDateWidget(forms.TextInput):
     class Media:
@@ -73 +74 @@
         if value:
             output.append('Currently: <a target="_blank" href="%s%s">%s</a> <br>Change: ' % (settings.MEDIA_URL, value, value))
         output.append(super(AdminFileWidget, self).render(name, value, attrs))
-        return u''.join(output)
+        return mark_safe(u''.join(output))
 
 class ForeignKeyRawIdWidget(forms.TextInput):
     """
@@ -99 +100 @@
         output.append('<a href="%s%s" class="related-lookup" id="lookup_id_%s" onclick="return showRelatedObjectLookupPopup(this);"> ' % \
             (related_url, url, name))
         output.append('<img src="%simg/admin/selector-search.gif" width="16" height="16" alt="Lookup"></a>' % settings.ADMIN_MEDIA_PREFIX)
-        return u''.join(output)
+        return mark_safe(u''.join(output))
         #if self.change: # TODO
             #output.append('&nbsp;<strong>TODO</strong>')
             
@@ -148 +149 @@
             output.append(u'<a href="%sadd/" class="add-another" id="add_id_%s" onclick="return showAddAnotherPopup(this);"> ' % \
                 (related_url, name))
             output.append(u'<img src="%simg/admin/icon_addlink.gif" width="10" height="10" alt="Add Another"/></a>' % settings.ADMIN_MEDIA_PREFIX)
-        return u''.join(output)
+        return mark_safe(u''.join(output))
 
     def __deepcopy__(self, memo):
         # There's no reason to deepcopy admin_site, etc, so just return self.