entrouvert
/
combo
16
1
Fork 0
Code Issues Pull Requests 11 Releases Wiki Activity

wcs: don't escape result of card cell custom fields (#61391)

This commit is contained in:
Lauréline Guérin 2022-03-10 10:50:46 +01:00
parent 7288306d47
commit ce69ea73d2
No known key found for this signature in database
GPG Key ID: 1FAB9B9B4F93D473
2 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
combo/apps/wcs/models.py
View File

@ -1302,7 +1302,7 @@ class WcsCardInfosCell(CardMixin, CellBase):
return extra_context
extra_context['card'] = card_data
custom_context = Context(extra_context)
custom_context = Context(extra_context, autoescape=False)
custom_context.update(context)
repeat_index = getattr(self, 'repeat_index', context.get('repeat_index')) or 0
custom_context['repeat_index'] = repeat_index

17
tests/test_wcs.py
View File

@ -141,7 +141,7 @@ WCS_CARDS_DATA = {
'fieldb': True,
'fieldc': '2020-09-28',
'fieldd': {'filename': 'file.pdf', 'url': 'http://127.0.0.1:8999/download?f=42'},
'fielde': 'lorem<strong>ipsum\n\nhello world',
'fielde': "lorem<strong>ipsum\n\nhello'world",
'fieldf': 'lorem<strong>ipsum\n\nhello world',
'fieldg': 'test@localhost',
'fieldh': 'https://www.example.net/',
@ -2553,7 +2553,7 @@ def test_card_cell_render_text_field(mock_send, context):
)
assert (
PyQuery(result).find('.label:contains("Field E") + .value p:last-child').text().strip()
== 'hello world'
== "hello'world"
)
# field F is put in a <pre>
@ -2719,9 +2719,12 @@ def test_card_cell_render_custom_schema_card_field(mock_send, context):
}
cell.save()
result = cell.render(context)
# check multiline text field is rendered with multiple paragraphs
# (first line "lorem<strong>ipsum" and last line ("hello'world")
# and the content is kept properly escaped.
assert PyQuery(result).find('.label').text() == 'Field E'
assert PyQuery(result).find('.value p:first-child').text().strip() == 'lorem<strong>ipsum'
assert PyQuery(result).find('.value p:last-child').text().strip() == 'hello world'
assert PyQuery(result).find('.value p:last-child').text().strip() == "hello'world"
cell.custom_schema['cells'][0] = {
'varname': 'fieldf',
@ -2861,7 +2864,11 @@ def test_card_cell_render_custom_schema_custom_entry(mock_send, context, app):
carddef_reference='default:card_model_1',
custom_schema={
'cells': [
{'varname': '@custom@', 'template': '<b>Foo</b> bar baz', 'display_mode': 'title'},
{
'varname': '@custom@',
'template': "<b>Foo</b> bar'baz {{ card.fields.fielde }}",
'display_mode': 'title',
},
]
},
)
@ -2874,7 +2881,7 @@ def test_card_cell_render_custom_schema_custom_entry(mock_send, context, app):
result = cell.render(context)
assert '&lt;b&gt;Foo&lt;/b&gt;' in result
assert PyQuery(result).find('h3').text() == '<b>Foo</b> bar baz'
assert PyQuery(result).find('h3').text() == "<b>Foo</b> bar'baz lorem<strong>ipsum hello'world"
# test context
cell.custom_schema['cells'][0][