Fixed #6948 -- The join filter was escaping the literal value that was

passed in for the connector. This was contrary to what the documentation
for autoescaping said and to what every other filter does with literal
strings as arguments.

This is backwards incompatible for the situation of the literal string
containing one of the five special HTML characters: if you were writing
{{ foo|join:"&" }}, you now have to write {{ foo| join:"&" }}.
Previous behaviour was, as noted, a bug and contrary to what was
documented and expected.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@9442 bcc190cf-cafb-0310-a4f2-bffc1f526a37

django/template/defaultfilters.py

@@ -481,19 +481,20 @@ def first(value):
         return u''
 first.is_safe = False
 
-def join(value, arg):
-    """Joins a list with a string, like Python's ``str.join(list)``."""
+def join(value, arg, autoescape=None):
+    """
+    Joins a list with a string, like Python's ``str.join(list)``.
+    """
+    if autoescape:
+        from django.utils.html import conditional_escape
+        value = [conditional_escape(v) for v in value]
     try:
-        data = arg.join(map(force_unicode, value))
+        data = arg.join(value)
     except AttributeError: # fail silently but nicely
         return value
-    safe_args = reduce(lambda lhs, rhs: lhs and isinstance(rhs, SafeData),
-            value, True)
-    if safe_args:
     return mark_safe(data)
-    else:
-        return data
 join.is_safe = True
+join.needs_autoescape = True
 
 def last(value):
     "Returns the last item in a list"

tests/regressiontests/templates/filters.py

@@ -281,5 +281,10 @@ def get_filter_tests():
         # Boolean return value from length_is should not be coerced to a string
         'lengthis01': (r'{% if "X"|length_is:0 %}Length is 0{% else %}Length not 0{% endif %}', {}, 'Length not 0'),
         'lengthis02': (r'{% if "X"|length_is:1 %}Length is 1{% else %}Length not 1{% endif %}', {}, 'Length is 1'),
+
+        'join01': (r'{{ a|join:", " }}', {'a': ['alpha', 'beta & me']}, 'alpha, beta & me'),
+        'join02': (r'{% autoescape off %}{{ a|join:", " }}{% endautoescape %}', {'a': ['alpha', 'beta & me']}, 'alpha, beta & me'),
+        'join03': (r'{{ a|join:" & " }}', {'a': ['alpha', 'beta & me']}, 'alpha & beta & me'),
+        'join04': (r'{% autoescape off %}{{ a|join:" & " }}{% endautoescape %}', {'a': ['alpha', 'beta & me']}, 'alpha & beta & me'),
     }