Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

Fixed #2986 -- Made the JavaScript code that drives related model ins…

…tance addition in a popup window handle a model representation containing new lines. Also, moved the escapejs functionality yoo django.utils.html so it can be used from Python code. Thanks andrewwatts for the patch.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15131 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 0f783b7f4eac037e22875eeeb6dc85c26b2a65f4 1 parent 544ab30
Ramiro Morales authored January 02, 2011
4  django/contrib/admin/options.py
@@ -19,7 +19,7 @@
19 19
 from django.utils.decorators import method_decorator
20 20
 from django.utils.datastructures import SortedDict
21 21
 from django.utils.functional import update_wrapper
22  
-from django.utils.html import escape
  22
+from django.utils.html import escape, escapejs
23 23
 from django.utils.safestring import mark_safe
24 24
 from django.utils.functional import curry
25 25
 from django.utils.text import capfirst, get_text_list
@@ -717,7 +717,7 @@ def response_add(self, request, obj, post_url_continue='../%s/'):
717 717
         if "_popup" in request.POST:
718 718
             return HttpResponse('<script type="text/javascript">opener.dismissAddAnotherPopup(window, "%s", "%s");</script>' % \
719 719
                 # escape() calls force_unicode.
720  
-                (escape(pk_value), escape(obj)))
  720
+                (escape(pk_value), escapejs(obj)))
721 721
         elif "_addanother" in request.POST:
722 722
             self.message_user(request, msg + ' ' + (_("You may add another %s below.") % force_unicode(opts.verbose_name)))
723 723
             return HttpResponseRedirect(request.path)
24  django/template/defaultfilters.py
@@ -64,29 +64,10 @@ def capfirst(value):
64 64
 capfirst.is_safe=True
65 65
 capfirst = stringfilter(capfirst)
66 66
 
67  
-_base_js_escapes = (
68  
-    ('\\', r'\u005C'),
69  
-    ('\'', r'\u0027'),
70  
-    ('"', r'\u0022'),
71  
-    ('>', r'\u003E'),
72  
-    ('<', r'\u003C'),
73  
-    ('&', r'\u0026'),
74  
-    ('=', r'\u003D'),
75  
-    ('-', r'\u002D'),
76  
-    (';', r'\u003B'),
77  
-    (u'\u2028', r'\u2028'),
78  
-    (u'\u2029', r'\u2029')
79  
-)
80  
-
81  
-# Escape every ASCII character with a value less than 32.
82  
-_js_escapes = (_base_js_escapes +
83  
-               tuple([('%c' % z, '\\u%04X' % z) for z in range(32)]))
84  
-
85 67
 def escapejs(value):
86 68
     """Hex encodes characters for use in JavaScript strings."""
87  
-    for bad, good in _js_escapes:
88  
-        value = value.replace(bad, good)
89  
-    return value
  69
+    from django.utils.html import escapejs
  70
+    return escapejs(value)
90 71
 escapejs = stringfilter(escapejs)
91 72
 
92 73
 def fix_ampersands(value):
@@ -745,7 +726,6 @@ def timesince(value, arg=None):
745 726
 def timeuntil(value, arg=None):
746 727
     """Formats a date as the time until that date (i.e. "4 days, 6 hours")."""
747 728
     from django.utils.timesince import timeuntil
748  
-    from datetime import datetime
749 729
     if not value:
750 730
         return u''
751 731
     try:
25  django/utils/html.py
@@ -34,6 +34,31 @@ def escape(html):
34 34
     return mark_safe(force_unicode(html).replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;').replace('"', '&quot;').replace("'", '&#39;'))
35 35
 escape = allow_lazy(escape, unicode)
36 36
 
  37
+_base_js_escapes = (
  38
+    ('\\', r'\u005C'),
  39
+    ('\'', r'\u0027'),
  40
+    ('"', r'\u0022'),
  41
+    ('>', r'\u003E'),
  42
+    ('<', r'\u003C'),
  43
+    ('&', r'\u0026'),
  44
+    ('=', r'\u003D'),
  45
+    ('-', r'\u002D'),
  46
+    (';', r'\u003B'),
  47
+    (u'\u2028', r'\u2028'),
  48
+    (u'\u2029', r'\u2029')
  49
+)
  50
+
  51
+# Escape every ASCII character with a value less than 32.
  52
+_js_escapes = (_base_js_escapes +
  53
+               tuple([('%c' % z, '\\u%04X' % z) for z in range(32)]))
  54
+
  55
+def escapejs(value):
  56
+    """Hex encodes characters for use in JavaScript strings."""
  57
+    for bad, good in _js_escapes:
  58
+        value = mark_safe(force_unicode(value).replace(bad, good))
  59
+    return value
  60
+escapejs = allow_lazy(escapejs, unicode)
  61
+
37 62
 def conditional_escape(html):
38 63
     """
39 64
     Similar to escape(), except that it doesn't operate on pre-escaped strings.
16  tests/regressiontests/admin_views/tests.py
@@ -107,6 +107,22 @@ def testBasicAddPost(self):
107 107
         response = self.client.post('/test_admin/%s/admin_views/section/add/' % self.urlbit, post_data)
108 108
         self.assertEqual(response.status_code, 302) # redirect somewhere
109 109
 
  110
+    def testPopupAddPost(self):
  111
+        """
  112
+        Ensure http response from a popup is properly escaped.
  113
+        """
  114
+        post_data = {
  115
+            '_popup': u'1',
  116
+            'title': u'title with a new\nline',
  117
+            'content': u'some content',
  118
+            'date_0': u'2010-09-10',
  119
+            'date_1': u'14:55:39',
  120
+        }
  121
+        response = self.client.post('/test_admin/%s/admin_views/article/add/' % self.urlbit, post_data)
  122
+        self.failUnlessEqual(response.status_code, 200)
  123
+        self.assertContains(response, 'dismissAddAnotherPopup')
  124
+        self.assertContains(response, 'title with a new\u000Aline')
  125
+
110 126
     # Post data for edit inline
111 127
     inline_post_data = {
112 128
         "name": u"Test section",
12  tests/regressiontests/utils/html.py
@@ -109,3 +109,15 @@ def test_fix_ampersands(self):
109 109
         )
110 110
         for value, output in items:
111 111
             self.check_output(f, value, output)
  112
+
  113
+    def test_escapejs(self):
  114
+        f = html.escapejs
  115
+        items = (
  116
+            (u'"double quotes" and \'single quotes\'', u'\\u0022double quotes\\u0022 and \\u0027single quotes\\u0027'),
  117
+            (ur'\ : backslashes, too', u'\\u005C : backslashes, too'),
  118
+            (u'and lots of whitespace: \r\n\t\v\f\b', u'and lots of whitespace: \\u000D\\u000A\\u0009\\u000B\\u000C\\u0008'),
  119
+            (ur'<script>and this</script>', u'\\u003Cscript\\u003Eand this\\u003C/script\\u003E'),
  120
+            (u'paragraph separator:\u2029and line separator:\u2028', u'paragraph separator:\\u2029and line separator:\\u2028'),
  121
+        )
  122
+        for value, output in items:
  123
+            self.check_output(f, value, output)

0 notes on commit 0f783b7

Please sign in to comment.
Something went wrong with that request. Please try again.