mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.7.x] Fixed #24461 -- Fixed XSS issue in ModelAdmin.readonly_fields

Browse Source
This commit is contained in:
Baptiste Mispelon
2015-03-08 11:50:32 +01:00
committed by Tim Graham
parent 5a3b531121
commit 2654e1b939
5 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
django/contrib/admin/helpers.py
View File

@@ -193,7 +193,7 @@ class AdminReadonlyField(object):
if getattr(attr, "allow_tags", False):
result_repr = mark_safe(result_repr)
else:
result_repr = linebreaksbr(result_repr)
result_repr = linebreaksbr(result_repr, autoescape=True)
else:
if isinstance(f.rel, ManyToManyRel) and value is not None:
result_repr = ", ".join(map(six.text_type, value.all()))