Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Loading…

using safestr in web.form.Dropdown._render_option #279

Merged
merged 3 commits into from

2 participants

@nopri

Convert to str (using safestr) before value comparison.

Old behavior (notice the second example):

d = Dropdown(name='a', args=[1,2,3], value=1)
>>> d.render()
u'<select id="a" name="a">\n  <option selected="selected" value="1">1</option>\n  <option value="2">2</option>\n  <option value="3">3</option>\n</select>\n'
>>> 
>>> d = Dropdown(name='a', args=[1,2,3], value='1')
>>> d.render()
u'<select id="a" name="a">\n  <option value="1">1</option>\n  <option value="2">2</option>\n  <option value="3">3</option>\n</select>\n'
>>> 

New behavior (also notice the second example):

>>> d = Dropdown(name='a', args=[1,2,3], value=1)
>>> d.render()
u'<select id="a" name="a">\n  <option selected="selected" value="1">1</option>\n  <option value="2">2</option>\n  <option value="3">3</option>\n</select>\n'
>>> 
>>> d = Dropdown(name='a', args=[1,2,3], value='1')
>>> d.render()
u'<select id="a" name="a">\n  <option selected="selected" value="1">1</option>\n  <option value="2">2</option>\n  <option value="3">3</option>\n</select>\n'
>>> 
@anandology
Collaborator

Look like your patch doesn't work for the multiple select case. could you please take care of that as well?

@nopri

Dear anandology,

Thank you very much for your comment and correction :)

I have updated the code.

Single selection, same type:

>>> print Dropdown(name='a', args=[1,2,3], value=1).render()
<select id="a" name="a">
  <option selected="selected" value="1">1</option>
  <option value="2">2</option>
  <option value="3">3</option>
</select>

Single selection, different type (notice: args):

>>> print Dropdown(name='a', args=['1',2,3], value=1).render()
<select id="a" name="a">
  <option selected="selected" value="1">1</option>
  <option value="2">2</option>
  <option value="3">3</option>
</select>

Single selection, different type (notice: value):

>>> print Dropdown(name='a', args=[1,2,3], value='1').render()
<select id="a" name="a">
  <option selected="selected" value="1">1</option>
  <option value="2">2</option>
  <option value="3">3</option>
</select>

Multiple selection, same type:

>>> print Dropdown(name='a', args=[1,2,3], value=[1,2]).render()
<select id="a" name="a">
  <option selected="selected" value="1">1</option>
  <option selected="selected" value="2">2</option>
  <option value="3">3</option>
</select>

Multiple selection, different type (also see below):

>>> print Dropdown(name='a', args=[1,2,3], value=['1','2']).render()
<select id="a" name="a">
  <option selected="selected" value="1">1</option>
  <option selected="selected" value="2">2</option>
  <option value="3">3</option>
</select>

Multiple selection, different type (mixed value):

>>> print Dropdown(name='a', args=[1,2,3], value=['1',2]).render()
<select id="a" name="a">
  <option selected="selected" value="1">1</option>
  <option selected="selected" value="2">2</option>
  <option value="3">3</option>
</select>

Thank you very much.

@anandology
Collaborator

I don't think it is a good idea to updating self.value when rending an option. May be you should assign it to a new variable instead of updating self.value.

@nopri

Dear anandology,

Again, thank you very much for your correction :)

I have updated the code.

@anandology anandology merged commit d666d65 into from
@anandology
Collaborator

Thanks @nopri.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
This page is out of date. Refresh to see the latest.
Showing with 7 additions and 1 deletion.
  1. +7 −1 web/form.py
View
8 web/form.py
@@ -253,7 +253,13 @@ def _render_option(self, arg, indent=' '):
else:
value, desc = arg, arg
- if self.value == value or (isinstance(self.value, list) and value in self.value):
+ value = utils.safestr(value)
+ if isinstance(self.value, (tuple, list)):
+ s_value = [utils.safestr(x) for x in self.value]
+ else:
+ s_value = utils.safestr(self.value)
+
+ if s_value == value or (isinstance(s_value, list) and value in s_value):
select_p = ' selected="selected"'
else:
select_p = ''
Something went wrong with that request. Please try again.