[1.10.x] Fixed XSS in admin's add/change related popup.

This is a security fix.

1 files changed, 2 insertions, 2 deletions

diff --git a/django/views/debug.py b/django/views/debug.py
index 56329325d3..eac0a77605 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -636,13 +636,13 @@ TECHNICAL_500_TEMPLATE = ("""
       var s = link.getElementsByTagName('span')[0];
       var uarr = String.fromCharCode(0x25b6);
       var darr = String.fromCharCode(0x25bc);
-      s.innerHTML = s.innerHTML == uarr ? darr : uarr;
+      s.textContent = s.textContent == uarr ? darr : uarr;
       return false;
     }
     function switchPastebinFriendly(link) {
       s1 = "Switch to copy-and-paste view";
       s2 = "Switch back to interactive view";
-      link.innerHTML = link.innerHTML.trim() == s1 ? s2: s1;
+      link.textContent = link.textContent.trim() == s1 ? s2: s1;
       toggle('browserTraceback', 'pastebinTraceback');
       return false;
     }