p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
19,492 Commits 25 Branches 361 Tags 501 MiB
Python 70.5%
Modelica 27.4%
HTML 1%
JavaScript 0.7%
CSS 0.4%
Go to file
Aymeric Augustin 6d52f6f8e6 Fixed #23831 -- Supported strings escaped by third-party libs in Django. 
Refs #7261 -- Made strings escaped by Django usable in third-party libs.

The changes in mark_safe and mark_for_escaping are straightforward. The
more tricky part is to handle correctly objects that implement __html__.

Historically escape() has escaped SafeData. Even if that doesn't seem a
good behavior, changing it would create security concerns. Therefore
support for __html__() was only added to conditional_escape() where this
concern doesn't exist.

Then using conditional_escape() instead of escape() in the Django
template engine makes it understand data escaped by other libraries.

Template filter |escape accounts for __html__() when it's available.
|force_escape forces the use of Django's HTML escaping implementation.

Here's why the change in render_value_in_context() is safe. Before Django
1.7 conditional_escape() was implemented as follows:

    if isinstance(text, SafeData):
        return text
    else:
        return escape(text)

render_value_in_context() never called escape() on SafeData. Therefore
replacing escape() with conditional_escape() doesn't change the
autoescaping logic as it was originally intended.

This change should be backported to Django 1.7 because it corrects a
feature added in Django 1.7.

Thanks mitsuhiko for the report.
 		2014-12-27 18:02:34 +01:00
.tx Fixed #23677 -- Removed contrib.formtools 2014-11-26 09:56:33 -05:00
django Fixed #23831 -- Supported strings escaped by third-party libs in Django. 2014-12-27 18:02:34 +01:00
docs Fixed #24000 -- Corrected contrib.sites default site creation in a multiple database setup. 2014-12-27 09:42:13 -05:00
extras Removed extras/csrf_migration_helper.py 2014-06-09 11:53:09 -04:00
scripts Converted Django scripts to argparse 2014-06-09 10:13:37 +02:00
tests Fixed #23831 -- Supported strings escaped by third-party libs in Django. 2014-12-27 18:02:34 +01:00
.gitattributes Force Unix-style line-endings for some helper files in staticfiles_tests. 2013-09-30 22:14:54 -03:00
.gitignore Added __pycache__ to gitignore 2013-09-19 06:37:23 -04:00
.hgignore Sycned .hginore with .gitignore. 2014-04-26 15:39:55 +02:00
AUTHORS Fixed #23998 -- Added datetime.time support to migrations questioner. 2014-12-22 07:24:54 -05:00
CONTRIBUTING.rst Fixed #21609 -- Amended CONTRIBUTING.rst pull request guidelines. 2013-12-26 13:41:03 -05:00
INSTALL Bumped minimum Python version requirement to 2.7 in Django 1.7. 2013-07-01 12:01:59 +02:00
LICENSE Whitespace cleanup. 2013-10-10 16:49:20 -04:00
MANIFEST.in Added RasterSource/GDALBand GDAL objects 2014-12-23 16:36:18 +01:00
README.rst Converted links to HTTPS and linked to stable docs. 2013-12-29 22:35:37 +01:00
setup.cfg Added some directories on Jenkins to flake8 exclude. 2014-11-20 11:58:24 -05:00
setup.py Include an 'extra_requires' for bcrypt 2014-04-17 11:28:09 -07:00

README.rst 

Django is a high-level Python Web framework that encourages rapid development
and clean, pragmatic design. Thanks for checking it out.

All documentation is in the "docs" directory and online at
https://docs.djangoproject.com/en/stable/. If you're just getting started,
here's how we recommend you read the docs:

* First, read docs/intro/install.txt for instructions on installing Django.

* Next, work through the tutorials in order (docs/intro/tutorial01.txt,
  docs/intro/tutorial02.txt, etc.).

* If you want to set up an actual deployment server, read
  docs/howto/deployment/index.txt for instructions.

* You'll probably want to read through the topical guides (in docs/topics)
  next; from there you can jump to the HOWTOs (in docs/howto) for specific
  problems, and check out the reference (docs/ref) for gory details.

* See docs/README for instructions on building an HTML version of the docs.

Docs are updated rigorously. If you find any problems in the docs, or think
they should be clarified in any way, please take 30 seconds to fill out a
ticket here: https://code.djangoproject.com/newticket

To get more help:

* Join the #django channel on irc.freenode.net. Lots of helpful people hang out
  there. Read the archives at http://django-irc-logs.com/.

* Join the django-users mailing list, or read the archives, at
  https://groups.google.com/group/django-users.

To contribute to Django:

* Check out https://www.djangoproject.com/community/ for information about
  getting involved.

To run Django's test suite:

* Follow the instructions in the "Unit tests" section of
  docs/internals/contributing/writing-code/unit-tests.txt, published online at
  https://docs.djangoproject.com/en/dev/internals/contributing/writing-code/unit-tests/#running-the-unit-tests