Prevent double-escaping of rich text blocks on Jinja2

Fixes #2542. Thanks to @aaugustin for the bug report and patch.
pull/2859/merge
Matt Westcott 2016-07-20 14:08:26 +01:00
rodzic 6d6da5c1a9
commit 71cf921407
3 zmienionych plików z 25 dodań i 1 usunięć

Wyświetl plik

@ -193,8 +193,11 @@ class RichText(object):
def __init__(self, source):
self.source = (source or '')
def __html__(self):
return '<div class="rich-text">' + expand_db_html(self.source) + '</div>'
def __str__(self):
return mark_safe('<div class="rich-text">' + expand_db_html(self.source) + '</div>')
return mark_safe(self.__html__())
def __bool__(self):
return bool(self.source)

Wyświetl plik

@ -52,6 +52,8 @@ class TestCoreJinja(TestCase):
class TestJinjaEscaping(TestCase):
fixtures = ['test.json']
def test_block_render_result_is_safe(self):
"""
Ensure that any results of template rendering in block.render are marked safe
@ -70,3 +72,21 @@ class TestJinjaEscaping(TestCase):
})
self.assertIn('<p>hello world</p>', result)
def test_rich_text_is_safe(self):
"""
Ensure that RichText values are marked safe
so that they don't get double-escaped when inserted into a parent template (#2542)
"""
stream_block = blocks.StreamBlock([
('paragraph', blocks.RichTextBlock(template='tests/jinja2/rich_text.html'))
])
stream_value = stream_block.to_python([
{'type': 'paragraph', 'value': '<p>Merry <a linktype="page" id="4">Christmas</a>!</p>'},
])
result = render_to_string('tests/jinja2/stream.html', {
'value': stream_value,
})
self.assertIn('<div class="rich-text"><p>Merry <a href="/events/christmas/">Christmas</a>!</p></div>', result)