Fixed #25165 -- Removed inline JavaScript from the admin.

This allows setting a Content-Security-Policy HTTP header
(refs #15727).

Special thanks to blighj, the original author of this patch.

2 files changed, 24 insertions, 14 deletions

diff --git a/tests/admin_inlines/test_templates.py b/tests/admin_inlines/test_templates.py
index 1ed52c9115..236ec5df7b 100644
--- a/tests/admin_inlines/test_templates.py
+++ b/tests/admin_inlines/test_templates.py
@@ -1,5 +1,7 @@
 from __future__ import unicode_literals
 
+import json
+
 from django.template.loader import render_to_string
 from django.test import SimpleTestCase
 
@@ -8,14 +10,16 @@ class TestTemplates(SimpleTestCase):
     def test_javascript_escaping(self):
         context = {
             'inline_admin_formset': {
-                'formset': {'prefix': 'my-prefix'},
-                'opts': {'verbose_name': 'verbose name\\'},
+                'inline_formset_data': json.dumps({
+                    'formset': {'prefix': 'my-prefix'},
+                    'opts': {'verbose_name': 'verbose name\\'},
+                }),
             },
         }
         output = render_to_string('admin/edit_inline/stacked.html', context)
-        self.assertIn('prefix: "my\\u002Dprefix",', output)
-        self.assertIn('addText: "Add another Verbose name\\u005C"', output)
+        self.assertIn('"prefix": "my-prefix"', output)
+        self.assertIn('"verbose_name": "verbose name\\\\"', output)
 
         output = render_to_string('admin/edit_inline/tabular.html', context)
-        self.assertIn('prefix: "my\\u002Dprefix",', output)
-        self.assertIn('addText: "Add another Verbose name\\u005C"', output)
+        self.assertIn('"prefix": "my-prefix"', output)
+        self.assertIn('"verbose_name": "verbose name\\\\"', output)
diff --git a/tests/admin_inlines/tests.py b/tests/admin_inlines/tests.py
index 4f2377b2de..b2102480bc 100644
--- a/tests/admin_inlines/tests.py
+++ b/tests/admin_inlines/tests.py
@@ -76,7 +76,7 @@ class TestInline(TestDataMixin, TestCase):
         # The heading for the m2m inline block uses the right text
         self.assertContains(response, '<h2>Author-book relationships</h2>')
         # The "add another" label is correct
-        self.assertContains(response, 'Add another Author\\u002Dbook relationship')
+        self.assertContains(response, 'Add another Author-book relationship')
         # The '+' is dropped from the autogenerated form prefix (Author_books+)
         self.assertContains(response, 'id="id_Author_books-TOTAL_FORMS"')
 
@@ -133,14 +133,20 @@ class TestInline(TestDataMixin, TestCase):
         response = self.client.get(reverse('admin:admin_inlines_novel_add'))
         self.assertEqual(response.status_code, 200)
         # View should have the child inlines section
-        self.assertContains(response, '<div class="inline-group" id="chapter_set-group">')
+        self.assertContains(
+            response,
+            '<div class="js-inline-admin-formset inline-group" id="chapter_set-group"'
+        )
 
     def test_callable_lookup(self):
         """Admin inline should invoke local callable when its name is listed in readonly_fields"""
         response = self.client.get(reverse('admin:admin_inlines_poll_add'))
         self.assertEqual(response.status_code, 200)
         # Add parent object view should have the child inlines section
-        self.assertContains(response, '<div class="inline-group" id="question_set-group">')
+        self.assertContains(
+            response,
+            '<div class="js-inline-admin-formset inline-group" id="question_set-group"'
+        )
         # The right callable should be used for the inline readonly_fields
         # column cells
         self.assertContains(response, '<p>Callable in QuestionInline</p>')
@@ -548,7 +554,7 @@ class TestInlinePermissions(TestCase):
         response = self.client.get(reverse('admin:admin_inlines_author_add'))
         # No change permission on books, so no inline
         self.assertNotContains(response, '<h2>Author-book relationships</h2>')
-        self.assertNotContains(response, 'Add another Author\\u002DBook Relationship')
+        self.assertNotContains(response, 'Add another Author-Book Relationship')
         self.assertNotContains(response, 'id="id_Author_books-TOTAL_FORMS"')
 
     def test_inline_add_fk_noperm(self):
@@ -562,7 +568,7 @@ class TestInlinePermissions(TestCase):
         response = self.client.get(self.author_change_url)
         # No change permission on books, so no inline
         self.assertNotContains(response, '<h2>Author-book relationships</h2>')
-        self.assertNotContains(response, 'Add another Author\\u002DBook Relationship')
+        self.assertNotContains(response, 'Add another Author-Book Relationship')
         self.assertNotContains(response, 'id="id_Author_books-TOTAL_FORMS"')
 
     def test_inline_change_fk_noperm(self):
@@ -578,7 +584,7 @@ class TestInlinePermissions(TestCase):
         response = self.client.get(reverse('admin:admin_inlines_author_add'))
         # No change permission on Books, so no inline
         self.assertNotContains(response, '<h2>Author-book relationships</h2>')
-        self.assertNotContains(response, 'Add another Author\\u002DBook Relationship')
+        self.assertNotContains(response, 'Add another Author-Book Relationship')
         self.assertNotContains(response, 'id="id_Author_books-TOTAL_FORMS"')
 
     def test_inline_add_fk_add_perm(self):
@@ -597,7 +603,7 @@ class TestInlinePermissions(TestCase):
         response = self.client.get(self.author_change_url)
         # No change permission on books, so no inline
         self.assertNotContains(response, '<h2>Author-book relationships</h2>')
-        self.assertNotContains(response, 'Add another Author\\u002DBook Relationship')
+        self.assertNotContains(response, 'Add another Author-Book Relationship')
         self.assertNotContains(response, 'id="id_Author_books-TOTAL_FORMS"')
         self.assertNotContains(response, 'id="id_Author_books-0-DELETE"')
 
@@ -607,7 +613,7 @@ class TestInlinePermissions(TestCase):
         response = self.client.get(self.author_change_url)
         # We have change perm on books, so we can add/change/delete inlines
         self.assertContains(response, '<h2>Author-book relationships</h2>')
-        self.assertContains(response, 'Add another Author\\u002Dbook relationship')
+        self.assertContains(response, 'Add another Author-book relationship')
         self.assertContains(response, '<input type="hidden" id="id_Author_books-TOTAL_FORMS" '
                             'value="4" name="Author_books-TOTAL_FORMS" />', html=True)
         self.assertContains(