Merge pull request #44 from jardiacaj/html_format_#43

Use format_html for HTML-generating functions #43

battle/battle_renderer.py

@@ -1,4 +1,6 @@
-from battle.models import Battle, BattleSoldierInTurn
+from django.utils.html import conditional_escape
+
+from battle.models import Battle
 from finem_imperii.app_settings import BATTlE_TICKS_PER_TURN
 
 
@@ -11,13 +13,15 @@ def render_battle_for_view(battle: Battle):
         for battle_organization in battle_side.battleorganization_set.all():
             organizations[battle_organization.id] = {
                 'z': battle_side.z,
-                'name': battle_organization.organization.name,
+                'name': conditional_escape(
+                    battle_organization.organization.name),
                 'color': battle_organization.organization.color,
             }
             for battle_character in battle_organization.battlecharacter_set.all():
                 characters[battle_character.id] = {
                     'organization_id': battle_organization.id,
-                    'name': battle_character.character.name,
+                    'name': conditional_escape(
+                        battle_character.character.name),
                     'in_turn': {}
                 }
                 for battle_character_in_turn in battle_character.battlecharacterinturn_set.all():
@@ -27,8 +31,8 @@ def render_battle_for_view(battle: Battle):
                 units[battle_unit.id] = {
                     'character_id': battle_unit.owner_id,
                     'organization_id': battle_unit.battle_organization_id,
-                    'name': battle_unit.name,
-                    'type': battle_unit.type,
+                    'name': conditional_escape(battle_unit.name),
+                    'type': conditional_escape(battle_unit.type),
                     'in_turn': {}
                 }
                 for battle_unit_in_turn in battle_unit.battleunitinturn_set.all():
@@ -48,7 +52,8 @@ def render_battle_for_view(battle: Battle):
                             'x_pos': contubernium_in_turn.x_pos,
                             'z_pos': contubernium_in_turn.z_pos,
                             'ammo_remaining': contubernium_in_turn.ammo_remaining,
-                            'attack_type': contubernium_in_turn.attack_type_this_turn,
+                            'attack_type': conditional_escape(
+                                contubernium_in_turn.attack_type_this_turn),
                             'attack_target':
                                 contubernium_in_turn.contubernium_attacked_this_turn.battle_contubernium_id
                                 if contubernium_in_turn.contubernium_attacked_this_turn

character/models.py

@@ -5,6 +5,8 @@
 
 from django.urls import reverse
 from django.utils import timezone
+from django.utils.html import format_html
+from django.utils.safestring import mark_safe
 
 import organization.models.capability
 import organization.models.organization
@@ -227,11 +229,14 @@ def get_html_name(self):
         return result
 
     def get_html_link(self):
-        return '<a href="{}">{}</a>'.format(
-            self.get_absolute_url(), self.get_html_name()
+        return format_html(
+            '<a href="{url}">{name}</a>',
+            url=mark_safe(self.get_absolute_url()),
+            name=mark_safe(self.get_html_name())
         )
 
-    def total_carrying_capacity(self):
+    @staticmethod
+    def total_carrying_capacity():
         return 100
 
     def remaining_carrying_capacity(self):

character/templates/character/travel_map_iframe.html

@@ -6,7 +6,7 @@
 
     <script>
         $(function () {
-            var map = new MapRenderer({{ regions|safe }});
+            var map = new MapRenderer({{ world_data|safe }});
             map.focus_to_region({{ request.hero.location.tile_id }});
             map.enable_region_tags();
             map.enable_settlement_tags();

character/templates/character/view_character_iframe.html

@@ -6,7 +6,7 @@
 
     <script>
         $(function () {
-            var map = new MapRenderer({{ regions|safe }});
+            var map = new MapRenderer({{ world_data|safe }});
             map.focus_to_region({{ character.location.tile.id }});
             map.highlight_settlement({{ character.location_id }});
             map.enable_region_tags();

character/views/travel.py

@@ -92,7 +92,7 @@ def travel_view_iframe(request, settlement_id=None):
     world = request.hero.world
     context = {
         'world': world,
-        'regions': render_world_for_view(world),
+        'world_data': render_world_for_view(world),
         'target_settlement': target_settlement,
     }
     return render(request, 'character/travel_map_iframe.html', context)

character/views/views.py

@@ -41,7 +41,7 @@ def character_view_iframe(request, character_id):
     )
     context = {
         'character': character,
-        'regions': render_world_for_view(character.world),
+        'world_data': render_world_for_view(character.world),
     }
     return render(request,
                   'character/view_character_iframe.html', context)

messaging/models.py

@@ -1,5 +1,6 @@
 from django.db import models
 from django.urls.base import reverse
+from django.utils.html import format_html
 
 
 class ServerMOTD(models.Model):
@@ -11,6 +12,9 @@ class Meta:
     display_order = models.SmallIntegerField()
     draft = models.BooleanField(default=True)
 
+    def get_html_content(self):
+        return format_html(self.html_content)
+
     def __str__(self):
         return self.title
 

organization/models/document.py

@@ -1,5 +1,6 @@
 from django.db import models
 from django.urls import reverse
+from django.utils.html import format_html
 
 
 class PolicyDocument(models.Model):
@@ -19,7 +20,7 @@ def get_absolute_url(self):
             'organization:document', kwargs={'document_id': self.id})
 
     def get_html_link(self):
-        return '<a href="{}">{}</a>'.format(
-            self.get_absolute_url(),
-            self.title,
-        )
+        return format_html('<a href="{url}">{name}</a>',
+                           url=self.get_absolute_url(),
+                           name=self.title,
+                           )

organization/models/organization.py

@@ -1,6 +1,7 @@
 from django.db import models, transaction
 from django.urls import reverse
-from django.utils.html import escape
+from django.utils.html import escape, format_html
+from django.utils.safestring import mark_safe
 
 import organization.models.capability
 import organization.models.document
@@ -313,10 +314,11 @@ def get_html_name(self):
         else:
             suffix = ''
 
-        return template.format(
-            name=escape(self.name),
-            icon=icon,
-            suffix=suffix
+        return format_html(
+            template,
+            name=self.name,
+            icon=mark_safe(icon),
+            suffix=mark_safe(suffix)
         )
 
     def get_bootstrap_icon(self):
@@ -337,15 +339,16 @@ def get_bootstrap_icon(self):
             icon = "triangle-top"
         else:
             icon = "option-vertical"
-        return template.format(
-            icon=icon,
-            color=escape(self.color),
-        )
+        return format_html(template,
+                           icon=icon,
+                           color=escape(self.color),
+                           )
 
     def get_html_link(self):
-        return '<a href="{}">{}</a>'.format(
-            self.get_absolute_url(),
-            self.get_html_name()
+        return format_html(
+            '<a href="{url}">{name}</a>',
+            url=mark_safe(self.get_absolute_url()),
+            name=mark_safe(self.get_html_name())
         )
 
     def current_elections_can_vote_in(self):

organization/models/relationship.py

@@ -1,4 +1,5 @@
 from django.db import models, transaction
+from django.utils.html import format_html
 
 
 class OrganizationRelationship(models.Model):
@@ -65,7 +66,10 @@ def _format_relationship(relationship, relationship_name):
         )
 
     def get_relationship_html(self):
-        return OrganizationRelationship._format_relationship(self.relationship, self.get_relationship_display())
+        return OrganizationRelationship._format_relationship(
+            self.relationship,
+            self.get_relationship_display()
+        )
 
     def get_desired_relationship_html(self):
         if self.desired_relationship is None:
@@ -122,7 +126,10 @@ def default_military_stance(self):
         return MilitaryStance.AVOID_BATTLE
 
     def __str__(self):
-        return "Relationship {} to {}".format(self.from_organization, self.to_organization)
+        return "Relationship {} to {}".format(
+            self.from_organization,
+            self.to_organization
+        )
 
 
 class MilitaryStance(models.Model):
@@ -172,7 +179,8 @@ def get_html_stance(self):
         else:
             bootstrap_type = 'default'
 
-        return '<span class="label label-{bootstrap_type}">{stance}</span>'.format(
+        return format_html(
+            '<span class="label label-{bootstrap_type}">{stance}</span>',
             bootstrap_type=bootstrap_type,
             stance=stance
         )

unit/models.py

@@ -2,9 +2,9 @@
 
 from django.db.models import Avg, F
 from django.urls import reverse
+from django.utils.html import format_html
 
 import character.models
-import world.models
 from battle.models import BattleUnit
 
 
@@ -79,10 +79,14 @@ class WorldUnit(models.Model):
         (5, "flanking far right"),
     )
 
-    owner_character = models.ForeignKey('character.Character', blank=True, null=True)
+    owner_character = models.ForeignKey(
+        'character.Character',
+        blank=True, null=True)
     world = models.ForeignKey('world.World', blank=True, null=True)
     location = models.ForeignKey('world.Settlement', blank=True, null=True)
-    origin = models.ForeignKey('world.Settlement', related_name='units_originating')
+    origin = models.ForeignKey(
+        'world.Settlement',
+        related_name='units_originating')
     name = models.CharField(max_length=100)
     recruitment_type = models.CharField(
         max_length=30, choices=RECRUITMENT_CHOICES
@@ -127,27 +131,26 @@ def __str__(self):
         return self.name
 
     def get_short_html_descriptor(self):
-        return '{} ' \
-               '<span class="unit-icon-{}" aria-hidden="true"></span>'.format(
+        return format_html(
+            '{} <span class="unit-icon-{}" aria-hidden="true"></span>',
             self.soldier.count(),
             self.type
         )
 
     def get_long_html_descriptor(self):
-        return '{} ' \
-               '<span class="unit-icon-{}" aria-hidden="true"></span> ' \
-               '{}'.format(
+        return format_html(
+            '{} <span class="unit-icon-{}" aria-hidden="true"></span> {}',
             self.soldier.count(),
             self.type,
             self.name
         )
 
     def get_html_link(self):
-        return '{} <a href="{}">{}</a>'.format(
-            self.get_short_html_descriptor(),
-            self.get_absolute_url(),
-            self.name
-        )
+        return format_html('{descriptor} <a href="{url}">{name}</a>',
+                           descriptor=self.get_short_html_descriptor(),
+                           url=self.get_absolute_url(),
+                           name=self.name
+                           )
 
     def get_absolute_url(self):
         return reverse('unit:unit', kwargs={'unit_id': self.id})

world/models/geography.py

@@ -4,6 +4,7 @@
 
 from django.db import models
 from django.urls import reverse
+from django.utils.html import format_html
 
 import organization.models.organization
 import unit.models
@@ -69,10 +70,10 @@ def get_current_date(self):
         return turn_to_date(self.current_turn)
 
     def get_html_link(self):
-        return '<a href="{}">{}</a>'.format(
-            self.get_absolute_url(),
-            self.name
-        )
+        return format_html('<a href="{url}">{name}</a>',
+                           url=self.get_absolute_url(),
+                           name=self.name
+                           )
 
     def get_absolute_url(self):
         return reverse('world:world', kwargs={'world_id': self.id})
@@ -126,9 +127,10 @@ def get_absolute_url(self):
         return reverse('world:tile', kwargs={'tile_id': self.id})
 
     def get_html_link(self):
-        return '<a href="{url}">{name}</a>'.format(
-            url=self.get_absolute_url(), name=self.name
-        )
+        return format_html('<a href="{url}">{name}</a>',
+                           url=self.get_absolute_url(),
+                           name=self.name
+                           )
 
     def get_absolute_coords(self):
         return Point(x=self.x_pos, z=self.z_pos)