[1.8.x] Fixed #24469 -- Refined escaping of Django's form elements in non-Django templates.

Backport of 1f2abf784a9fe550959de242d91963b2ad6f7e9c from master

4 files changed, 13 insertions, 12 deletions

diff --git a/django/forms/forms.py b/django/forms/forms.py
index 869cc83283..bad1843bb0 100644
--- a/django/forms/forms.py
+++ b/django/forms/forms.py
@@ -18,7 +18,7 @@ from django.utils.deprecation import RemovedInDjango19Warning
 from django.utils.encoding import (
     force_text, python_2_unicode_compatible, smart_text,
 )
-from django.utils.html import conditional_escape, format_html
+from django.utils.html import conditional_escape, format_html, html_safe
 from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext as _
 
@@ -108,6 +108,7 @@ class DeclarativeFieldsMetaclass(MediaDefiningClass):
         return new_class
 
 
+@html_safe
 @python_2_unicode_compatible
 class BaseForm(object):
     # This is the main implementation of all the Form logic. Note that this
@@ -138,9 +139,6 @@ class BaseForm(object):
         self.fields = copy.deepcopy(self.base_fields)
         self._bound_fields_cache = {}
 
-    def __html__(self):
-        return force_text(self)
-
     def __str__(self):
         return self.as_table()
 
@@ -520,6 +518,7 @@ class Form(six.with_metaclass(DeclarativeFieldsMetaclass, BaseForm)):
     # BaseForm itself has no way of designating self.fields.
 
 
+@html_safe
 @python_2_unicode_compatible
 class BoundField(object):
     "A Field plus data"
@@ -537,9 +536,6 @@ class BoundField(object):
         self.help_text = field.help_text or ''
         self._initial_value = UNSET
 
-    def __html__(self):
-        return force_text(self)
-
     def __str__(self):
         """Renders this field as an HTML widget."""
         if self.field.show_hidden_initial:
diff --git a/django/forms/formsets.py b/django/forms/formsets.py
index adacd00fdc..eafe35720f 100644
--- a/django/forms/formsets.py
+++ b/django/forms/formsets.py
@@ -8,6 +8,7 @@ from django.forms.widgets import HiddenInput
 from django.utils import six
 from django.utils.encoding import python_2_unicode_compatible
 from django.utils.functional import cached_property
+from django.utils.html import html_safe
 from django.utils.safestring import mark_safe
 from django.utils.six.moves import range
 from django.utils.translation import ugettext as _, ungettext
@@ -46,6 +47,7 @@ class ManagementForm(Form):
         super(ManagementForm, self).__init__(*args, **kwargs)
 
 
+@html_safe
 @python_2_unicode_compatible
 class BaseFormSet(object):
     """
diff --git a/django/forms/utils.py b/django/forms/utils.py
index 73a18622c1..717c3d0606 100644
--- a/django/forms/utils.py
+++ b/django/forms/utils.py
@@ -9,7 +9,7 @@ from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.utils import six, timezone
 from django.utils.encoding import force_text, python_2_unicode_compatible
-from django.utils.html import escape, format_html, format_html_join
+from django.utils.html import escape, format_html, format_html_join, html_safe
 from django.utils.translation import ugettext_lazy as _
 
 try:
@@ -42,6 +42,7 @@ def flatatt(attrs):
     )
 
 
+@html_safe
 @python_2_unicode_compatible
 class ErrorDict(dict):
     """
@@ -74,6 +75,7 @@ class ErrorDict(dict):
         return self.as_ul()
 
 
+@html_safe
 @python_2_unicode_compatible
 class ErrorList(UserList, list):
     """
diff --git a/django/forms/widgets.py b/django/forms/widgets.py
index 811852bb0b..43a88463ba 100644
--- a/django/forms/widgets.py
+++ b/django/forms/widgets.py
@@ -12,7 +12,7 @@ from django.forms.utils import flatatt, to_current_timezone
 from django.utils import formats, six
 from django.utils.datastructures import MergeDict, MultiValueDict
 from django.utils.encoding import force_text, python_2_unicode_compatible
-from django.utils.html import conditional_escape, format_html
+from django.utils.html import conditional_escape, format_html, html_safe
 from django.utils.safestring import mark_safe
 from django.utils.six.moves.urllib.parse import urljoin
 from django.utils.translation import ugettext_lazy
@@ -30,6 +30,7 @@ __all__ = (
 MEDIA_TYPES = ('css', 'js')
 
 
+@html_safe
 @python_2_unicode_compatible
 class Media(object):
     def __init__(self, media=None, **kwargs):
@@ -44,9 +45,6 @@ class Media(object):
         for name in MEDIA_TYPES:
             getattr(self, 'add_' + name)(media_attrs.get(name, None))
 
-    def __html__(self):
-        return force_text(self)
-
     def __str__(self):
         return self.render()
 
@@ -152,6 +150,7 @@ class MediaDefiningClass(type):
         return new_class
 
 
+@html_safe
 @python_2_unicode_compatible
 class SubWidget(object):
     """
@@ -595,6 +594,7 @@ class SelectMultiple(Select):
         return data.get(name, None)
 
 
+@html_safe
 @python_2_unicode_compatible
 class ChoiceInput(SubWidget):
     """
@@ -660,6 +660,7 @@ class CheckboxChoiceInput(ChoiceInput):
         return self.choice_value in self.value
 
 
+@html_safe
 @python_2_unicode_compatible
 class ChoiceFieldRenderer(object):
     """