[Django] #28874: Errors on hidden input fields print out double escaped HTML
Django
-------------------------------------------+------------------------
Reporter: Kyle Agronick | Owner: nobody
Type: Bug | Status: new
Component: Template system | Version: 1.11
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 1 |
-------------------------------------------+------------------------
Hidden input fields will print errors like "It\'s the thing &" as "(Hidden
field test) It's the thing &". with HTML that is double escaped as
{{{
<ul class="errorlist nonfield">
<li>(Hidden field test) It&#39;s the thing &amp;</li>
</ul>
}}}
Using this code:
views.py
{{{
class TestForm(forms.Form):
test = forms.CharField(widget=forms.HiddenInput(), required=False)
foo = forms.CharField()
class StoreGroupDelete(FormView):
form_class = TestForm
template_name = 'test/test_delete.html'
def form_valid(self, form):
form.add_error('test', 'It\'s the thing &')
return self.form_invalid(form)
}}}
test.html
{{{
<form method="post">
{% csrf_token %}
<ul>
{{ form.as_ul }}
</ul><input type="submit" />
</form>
}}}
This only happens on hidden inputs. Regular fields work fine. This is on
1.11.7.
--
Ticket URL: <https://code.djangoproject.com/ticket/28874>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
Reporter: Kyle Agronick | Owner: nobody
Type: Bug | Status: new
Component: Template system | Version: 1.11
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 1
Comment (by Daniil Ryzhkov):
I was able to reproduce this behaviour and can confirm that this only
happens for HiddenField. It works normally for CharField.
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:1>
Django
Reporter: Kyle Agronick | Owner: nobody
Type: Bug | Status: new
Component: Template system | Version: 1.11
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 1
Comment (by Daniil Ryzhkov):
I've checked Django code and it seems to be a django bug.
This
[https://github.com/django/django/blob/master/django/forms/forms.py#L207
line in django.forms.forms] breaks affect of {{{mark_safe}}}:
According to
[https://github.com/django/django/blame/fceefb4d25ab09e4884c7ead5e613bc2b63ee55f/django/forms/forms.py#L212
git blame], this issue should should be reproducible in every django
release for last 5 years:
I was able to fix this. I will write tests to cover this issue and submit
my changes as PR on github.
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:2>
Django
Reporter: Kyle Agronick | Owner: Daniil
| Ryzhkov
Type: Bug | Status: assigned
Component: Template system | Version: 1.11
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 1 | UI/UX: 1
Changes (by Daniil Ryzhkov):
* owner: nobody => Daniil Ryzhkov
* status: new => assigned
* cc: Daniil Ryzhkov (added)
* needs_tests: 0 => 1
* stage: Unreviewed => Accepted
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:3>
Django
Reporter: Kyle Agronick | Owner: Daniil
| Ryzhkov
Type: Bug | Status: assigned
Keywords: | Triage Stage: Ready for
| checkin
Has patch: 0 | Needs documentation: 0
Easy pickings: 1 | UI/UX: 1
Changes (by Daniil Ryzhkov):
* stage: Accepted => Ready for checkin
Comment:
[https://github.com/django/django/pull/9411PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:4>
Django
Reporter: Kyle Agronick | Owner: Daniil
| Ryzhkov
Type: Bug | Status: assigned
Keywords: | Triage Stage: Accepted
Easy pickings: 1 | UI/UX: 1
Changes (by Simon Charette):
* stage: Ready for checkin => Accepted
Comment:
Please don't mark your own patch as RFC.
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:5>
Django
Reporter: Kyle Agronick | Owner: Daniil
| Ryzhkov
Type: Bug | Status: assigned
Keywords: | Triage Stage: Accepted
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 1
Changes (by Daniil Ryzhkov):
* has_patch: 0 => 1
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:6>
Django
Reporter: Kyle Agronick | Owner: Daniil
| Ryzhkov
Component: Template system | Version: 1.11
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 1
Changes (by Tim Graham <timograham@…>):
* status: assigned => closed
* resolution: => fixed
Comment:
In [changeset:"7c7bc6391a3e83566f9ace59955e63503bc76cee" 7c7bc639]:
{{{
#!CommitTicketReference repository=""
revision="7c7bc6391a3e83566f9ace59955e63503bc76cee"
Fixed #28874 -- Prevented double escaping of errors on hidden form fields.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28874#comment:7>