diff options
| author | Alexandre Varas <346508+alej0varas@users.noreply.github.com> | 2019-06-05 20:12:21 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2019-06-07 07:51:45 +0200 |
| commit | c498f088c584ec3aff97409fdc11b39b28240de9 (patch) | |
| tree | 0f156b2cbf57c7d9cadeab5bb6245b4b19fada2f /django | |
| parent | 3fb0a1a67f0ca3e03db59a876f87e8d0828872c4 (diff) | |
Fixed #30521 -- Fixed invalid HTML in default error pages.
Diffstat (limited to 'django')
| -rw-r--r-- | django/views/defaults.py | 33 |
1 files changed, 28 insertions, 5 deletions
diff --git a/django/views/defaults.py b/django/views/defaults.py index 1176bdeeeb..2fb0d0b38c 100644 --- a/django/views/defaults.py +++ b/django/views/defaults.py @@ -11,6 +11,17 @@ ERROR_404_TEMPLATE_NAME = '404.html' ERROR_403_TEMPLATE_NAME = '403.html' ERROR_400_TEMPLATE_NAME = '400.html' ERROR_500_TEMPLATE_NAME = '500.html' +ERROR_PAGE_TEMPLATE = """ +<!doctype html> +<html lang="en"> +<head> + <title>%(title)s</title> +</head> +<body> + <h1>%(title)s</h1><p>%(details)s</p> +</body> +</html> +""" # This can be called when CsrfViewMiddleware.process_view has not run, @@ -55,8 +66,11 @@ def page_not_found(request, exception, template_name=ERROR_404_TEMPLATE_NAME): # Render template (even though there are no substitutions) to allow # inspecting the context in tests. template = Engine().from_string( - '<h1>Not Found</h1>' - '<p>The requested resource was not found on this server.</p>') + ERROR_PAGE_TEMPLATE % { + 'title': 'Not Found', + 'details': 'The requested resource was not found on this server.', + }, + ) body = template.render(Context(context)) content_type = 'text/html' return HttpResponseNotFound(body, content_type=content_type) @@ -76,7 +90,10 @@ def server_error(request, template_name=ERROR_500_TEMPLATE_NAME): if template_name != ERROR_500_TEMPLATE_NAME: # Reraise if it's a missing custom template. raise - return HttpResponseServerError('<h1>Server Error (500)</h1>', content_type='text/html') + return HttpResponseServerError( + ERROR_PAGE_TEMPLATE % {'title': 'Server Error (500)', 'details': ''}, + content_type='text/html', + ) return HttpResponseServerError(template.render()) @@ -94,7 +111,10 @@ def bad_request(request, exception, template_name=ERROR_400_TEMPLATE_NAME): if template_name != ERROR_400_TEMPLATE_NAME: # Reraise if it's a missing custom template. raise - return HttpResponseBadRequest('<h1>Bad Request (400)</h1>', content_type='text/html') + return HttpResponseBadRequest( + ERROR_PAGE_TEMPLATE % {'title': 'Bad Request (400)', 'details': ''}, + content_type='text/html', + ) # No exception content is passed to the template, to not disclose any sensitive information. return HttpResponseBadRequest(template.render()) @@ -119,7 +139,10 @@ def permission_denied(request, exception, template_name=ERROR_403_TEMPLATE_NAME) if template_name != ERROR_403_TEMPLATE_NAME: # Reraise if it's a missing custom template. raise - return HttpResponseForbidden('<h1>403 Forbidden</h1>', content_type='text/html') + return HttpResponseForbidden( + ERROR_PAGE_TEMPLATE % {'title': '403 Forbidden', 'details': ''}, + content_type='text/html', + ) return HttpResponseForbidden( template.render(request=request, context={'exception': str(exception)}) ) |