#25872: Title attribute for related widget links lacks escaping (and breaks
html)
-------------------------------+--------------------
Reporter: a1tus | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 1.9
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
This issue appears when using russian locale because corresponding
translated text fragment contains quotes there. While english locale and
manu others does not.
The problem is that title attributes for links in this file:
https://github.com/django/django/blob/1.9/django/contrib/admin/templates/admin/related_widget_wrapper.html
are not escaped at all. So title attribute ends before it must do and so
breaks html.
I suggest to wrap `blocktrans` blocks with `{% filter force_escape %}`
(already done it on my local django conf and everything worked seamless).
If it's the way to go, I can make PR.
This bug affects version 1.8 too.
--
Ticket URL: <https://code.djangoproject.com/ticket/25872>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/048.b48d0cafcaa416b76b7cbad28756f6ea%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
