← Back to branch summary

~ubuntu-branches/ubuntu/quantal/python-django/quantal-security

« back to all changes in this revision

Viewing changes to django/template/defaultfilters.py

  • Committer: Bazaar Package Importer
  • Author(s): Jamie Strandboge
  • Date: 2010-10-12 11:34:35 UTC
  • mfrom: (4.4.9 sid)
  • mto: This revision was merged to the branch mainline in revision 30.
  • Revision ID: james.westby@ubuntu.com-20101012113435-5rk3p18nyanuhj6g
* SECURITY UPDATE: XSS in CSRF protections. New upstream release
  - CVE-2010-3082
* debian/patches/01_disable_url_verify_regression_tests.diff:
  - updated to disable another test that fails without internet connection
  - patch based on work by Kai Kasurinen and Krzysztof Klimonda
* debian/control: don't Build-Depends on locales-all, which doesn't exist
  in maverick

Show diffs side-by-side

added added

removed removed

Lines of Context:
django/template/defaultfilters.py
11
11
from django.template import Variable, Library
12
12
from django.conf import settings
13
13
from django.utils import formats
14
 
from django.utils.translation import ugettext, ungettext
15
14
from django.utils.encoding import force_unicode, iri_to_uri
 
15
from django.utils.html import conditional_escape
16
16
from django.utils.safestring import mark_safe, SafeData
 
17
from django.utils.translation import ugettext, ungettext
17
18
 
18
19
register = Library()
19
20
 
255
256
    Truncates a string after a certain number of words.
256
257
 
257
258
    Argument: Number of words to truncate after.
 
259
 
 
260
    Newlines within the string are removed.
258
261
    """
259
262
    from django.utils.text import truncate_words
260
263
    try:
270
273
    Truncates HTML after a certain number of words.
271
274
 
272
275
    Argument: Number of words to truncate after.
 
276
 
 
277
    Newlines in the HTML are preserved.
273
278
    """
274
279
    from django.utils.text import truncate_html_words
275
280
    try:
496
501
    """
497
502
    value = map(force_unicode, value)
498
503
    if autoescape:
499
 
        from django.utils.html import conditional_escape
500
504
        value = [conditional_escape(v) for v in value]
501
505
    try:
502
 
        data = arg.join(value)
 
506
        data = conditional_escape(arg).join(value)
503
507
    except AttributeError: # fail silently but nicely
504
508
        return value
505
509
    return mark_safe(data)