Missing parameter escaping in admin filters.js

[Stanislav]

I am using ukrainian language in django admin. This language has an apostrophe that users often write as '.

My code:

class HasMasterFilter(admin.SimpleListFilter):
    title = "Пов'язаний?"

leads to error in /django/contrib/admin/static/admin/js/filters.js at the line:

const detailElement = document.querySelector(`[data-filter-title='${key}']`);

it's needed to escape the value in key

[Stanislav]

Patch:

14c14
<         const detailElement = document.querySelector(`[data-filter-title='${key}']`);
---
>         const detailElement = document.querySelector(`[data-filter-title='${CSS.escape(key)}']`);
30a31
> 

[Mariusz Felisiak]

Thanks for the report and testing against the alpha release!

Regression in 27aa7035f57f0db30b6632e4274e18b430906799.

[Mariusz Felisiak]

Stanislav, Can you send PR via GitHub? (a regression test is required.)

[Stanislav]

Replying to Mariusz Felisiak:

Stanislav, Can you send PR via GitHub? (a regression test is required.)

I hope i did it

[Marcelo Galigniana]

Replying to Stanislav:

Replying to Mariusz Felisiak:

Stanislav, Can you send PR via GitHub? (a regression test is required.)

I hope i did it

Hi Stanislav! I just saw your PR but it doesn’t have a new test. Marius means add a test like this: ​https://github.com/django/django/commit/27aa7035f57f0db30b6632e4274e18b430906799#diff-640602cc17dc3e9a26db47f58b40a1289d5c0f1b5b0fe547810b1d962f6cde8b. You could use it as a reference and add the escape case! Don’t forget update the issue status here too!

Let me know if you need help with something!

[Mariusz Felisiak]

​PR

[Stanislav]

Replying to Marcelo Galigniana:

Replying to Stanislav:

Replying to Mariusz Felisiak:

Stanislav, Can you send PR via GitHub? (a regression test is required.)

I hope i did it

Hi Stanislav! I just saw your PR but it doesn’t have a new test. Marius means add a test like this: ​https://github.com/django/django/commit/27aa7035f57f0db30b6632e4274e18b430906799#diff-640602cc17dc3e9a26db47f58b40a1289d5c0f1b5b0fe547810b1d962f6cde8b. You could use it as a reference and add the escape case! Don’t forget update the issue status here too!

Let me know if you need help with something!

​https://github.com/django/django/pull/16499
the error is related to js, ​​so I process the browser logs in selenium

[Mariusz Felisiak <felisiak.mariusz@…>]

In 7217c11e:

[4.2.x] Fixed #34283 -- Escaped title in admin's changelist filters.

Regression in 27aa7035f57f0db30b6632e4274e18b430906799.

Backport of 20a0850099340fb4cb8df0e4441e5019b2cbd1ea from main

[Mariusz Felisiak <felisiak.mariusz@…>]

In 20a0850:

Fixed #34283 -- Escaped title in admin's changelist filters.

Regression in 27aa7035f57f0db30b6632e4274e18b430906799.