[patch] ForeignKey fields not escaped correctly in django admin

[rushman@…]

Steps to reproduce:

1. two models m1 and m2
2. m2 has foreign key to m1 and this key in list_display set
3. m1 __str__ returns '<script>alert(1)</script>'

when you will open list of m2 objects in django admin - you should get some alerts.

Since this is security hole i'm setting severity to 'major'.

[rushman@…]

patch

[Adrian Holovaty]

(In [3124]) Fixed #2148 -- Now escaping ForeignKey fields correctly in Django admin change-list pages. Thanks, rushman@…