diff options
| author | Baptiste Mispelon <bmispelon@gmail.com> | 2015-03-08 11:50:32 +0100 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2015-03-09 10:15:12 -0400 |
| commit | 35d68e8e766217924375e1a91533fee50159291c (patch) | |
| tree | c56a28e971ef76f829ab0be93768625eac04c55d /tests/admin_views/tests.py | |
| parent | 980d604bf237b0e09a1c7754b74d1bb2bfed0b35 (diff) | |
[1.8.x] Refs #24461 -- Added test/release notes for XSS issue in ModelAdmin.readonly_fields
This issue was fixed by refs #24464.
Diffstat (limited to 'tests/admin_views/tests.py')
| -rw-r--r-- | tests/admin_views/tests.py | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/tests/admin_views/tests.py b/tests/admin_views/tests.py index 6425cb21df..925d8e6090 100644 --- a/tests/admin_views/tests.py +++ b/tests/admin_views/tests.py @@ -4114,6 +4114,15 @@ class ReadonlyTest(TestCase): self.assertContains(response, '<label for="id_public">Overridden public label:</label>', html=True) self.assertNotContains(response, "Some help text for the date (with unicode ŠĐĆŽćžšđ)") + def test_correct_autoescaping(self): + """ + Make sure that non-field readonly elements are properly autoescaped (#24461) + """ + section = Section.objects.create(name='<a>evil</a>') + response = self.client.get(reverse('admin:admin_views_section_change', args=(section.pk,))) + self.assertNotContains(response, "<a>evil</a>", status_code=200) + self.assertContains(response, "<a>evil</a>", status_code=200) + @override_settings(PASSWORD_HASHERS=('django.contrib.auth.hashers.SHA1PasswordHasher',), ROOT_URLCONF="admin_views.urls") |