diff options
| author | Claude Paroz <claude@2xlibre.net> | 2017-02-01 16:39:32 +0100 |
|---|---|---|
| committer | Claude Paroz <claude@2xlibre.net> | 2017-02-02 21:01:39 +0100 |
| commit | a21ec12409a5b72d602cd03ee925b6ceb1cd5492 (patch) | |
| tree | a50ea005b75db0a6de53a72fe3d8dcaa2e4a004f /django | |
| parent | f8d52521ab74e538f35c8dcf75760b5a2532c3b5 (diff) | |
Fixed #27803 -- Kept safe status of lazy safe strings in conditional_escape
Diffstat (limited to 'django')
| -rw-r--r-- | django/utils/html.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/django/utils/html.py b/django/utils/html.py index f7f9a63350..cb5a6258ac 100644 --- a/django/utils/html.py +++ b/django/utils/html.py @@ -6,7 +6,7 @@ from urllib.parse import ( ) from django.utils.encoding import force_text -from django.utils.functional import keep_lazy, keep_lazy_text +from django.utils.functional import Promise, keep_lazy, keep_lazy_text from django.utils.http import RFC3986_GENDELIMS, RFC3986_SUBDELIMS from django.utils.safestring import SafeData, SafeText, mark_safe from django.utils.text import normalize_newlines @@ -79,6 +79,8 @@ def conditional_escape(text): This function relies on the __html__ convention used both by Django's SafeData class and by third-party libraries like markupsafe. """ + if isinstance(text, Promise): + text = str(text) if hasattr(text, '__html__'): return text.__html__() else: |
