[1.8.x] Fixed #24469 -- Refined escaping of Django's form elements in non-Django templates.

Backport of 1f2abf784a9fe550959de242d91963b2ad6f7e9c from master

1 files changed, 3 insertions, 7 deletions

diff --git a/django/forms/forms.py b/django/forms/forms.py
index 869cc83283..bad1843bb0 100644
--- a/django/forms/forms.py
+++ b/django/forms/forms.py
@@ -18,7 +18,7 @@ from django.utils.deprecation import RemovedInDjango19Warning
 from django.utils.encoding import (
     force_text, python_2_unicode_compatible, smart_text,
 )
-from django.utils.html import conditional_escape, format_html
+from django.utils.html import conditional_escape, format_html, html_safe
 from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext as _
 
@@ -108,6 +108,7 @@ class DeclarativeFieldsMetaclass(MediaDefiningClass):
         return new_class
 
 
+@html_safe
 @python_2_unicode_compatible
 class BaseForm(object):
     # This is the main implementation of all the Form logic. Note that this
@@ -138,9 +139,6 @@ class BaseForm(object):
         self.fields = copy.deepcopy(self.base_fields)
         self._bound_fields_cache = {}
 
-    def __html__(self):
-        return force_text(self)
-
     def __str__(self):
         return self.as_table()
 
@@ -520,6 +518,7 @@ class Form(six.with_metaclass(DeclarativeFieldsMetaclass, BaseForm)):
     # BaseForm itself has no way of designating self.fields.
 
 
+@html_safe
 @python_2_unicode_compatible
 class BoundField(object):
     "A Field plus data"
@@ -537,9 +536,6 @@ class BoundField(object):
         self.help_text = field.help_text or ''
         self._initial_value = UNSET
 
-    def __html__(self):
-        return force_text(self)
-
     def __str__(self):
         """Renders this field as an HTML widget."""
         if self.field.show_hidden_initial: