Fixed CVE-2017-12794 -- Fixed XSS possibility in traceback section of technical 500 debug page.

This is a security fix.

1 files changed, 2 insertions, 2 deletions

diff --git a/django/views/debug.py b/django/views/debug.py
index fca137fd07..35cff6338f 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -8,7 +8,7 @@ from pathlib import Path
 from django.conf import settings
 from django.http import HttpResponse, HttpResponseNotFound
 from django.template import Context, Engine, TemplateDoesNotExist
-from django.template.defaultfilters import force_escape, pprint
+from django.template.defaultfilters import pprint
 from django.urls import Resolver404, resolve
 from django.utils import timezone
 from django.utils.datastructures import MultiValueDict
@@ -271,7 +271,7 @@ class ExceptionReporter:
                     # Trim large blobs of data
                     if len(v) > 4096:
                         v = '%s... <trimmed %d bytes string>' % (v[0:4096], len(v))
-                    frame_vars.append((k, force_escape(v)))
+                    frame_vars.append((k, v))
                 frame['vars'] = frame_vars
             frames[i] = frame