Fixed #6160, #9111 -- Consistently apply conditional_escape to form errors and labels when outputing them as HTML.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@9365 bcc190cf-cafb-0310-a4f2-bffc1f526a37

2 files changed, 5 insertions, 5 deletions

diff --git a/django/forms/forms.py b/django/forms/forms.py
index 3a6182611e..e28479fb8b 100644
--- a/django/forms/forms.py
+++ b/django/forms/forms.py
@@ -5,7 +5,7 @@ Form classes
 from copy import deepcopy
 
 from django.utils.datastructures import SortedDict
-from django.utils.html import escape
+from django.utils.html import conditional_escape
 from django.utils.encoding import StrAndUnicode, smart_unicode, force_unicode
 from django.utils.safestring import mark_safe
 
@@ -140,7 +140,7 @@ class BaseForm(StrAndUnicode):
         output, hidden_fields = [], []
         for name, field in self.fields.items():
             bf = BoundField(self, field, name)
-            bf_errors = self.error_class([escape(error) for error in bf.errors]) # Escape and cache in local variable.
+            bf_errors = self.error_class([conditional_escape(error) for error in bf.errors]) # Escape and cache in local variable.
             if bf.is_hidden:
                 if bf_errors:
                     top_errors.extend([u'(Hidden field %s) %s' % (name, force_unicode(e)) for e in bf_errors])
@@ -149,7 +149,7 @@ class BaseForm(StrAndUnicode):
                 if errors_on_separate_row and bf_errors:
                     output.append(error_row % force_unicode(bf_errors))
                 if bf.label:
-                    label = escape(force_unicode(bf.label))
+                    label = conditional_escape(force_unicode(bf.label))
                     # Only add the suffix if the label does not end in
                     # punctuation.
                     if self.label_suffix:
@@ -395,7 +395,7 @@ class BoundField(StrAndUnicode):
 
         If attrs are given, they're used as HTML attributes on the <label> tag.
         """
-        contents = contents or escape(self.label)
+        contents = contents or conditional_escape(self.label)
         widget = self.field.widget
         id_ = widget.attrs.get('id') or self.auto_id
         if id_:
diff --git a/django/forms/util.py b/django/forms/util.py
index ea936277b0..b9b88a61e6 100644
--- a/django/forms/util.py
+++ b/django/forms/util.py
@@ -39,7 +39,7 @@ class ErrorList(list, StrAndUnicode):
     def as_ul(self):
         if not self: return u''
         return mark_safe(u'<ul class="errorlist">%s</ul>'
-                % ''.join([u'<li>%s</li>' % force_unicode(e) for e in self]))
+                % ''.join([u'<li>%s</li>' % conditional_escape(force_unicode(e)) for e in self]))
 
     def as_text(self):
         if not self: return u''