misc: mark form digest as safe as it's considered as text (#25428)

tests/test_backoffice_pages.py

@@ -2564,12 +2564,12 @@ def test_global_listing(pub):
 
     # check digest is included
     formdata = formdef.data_class().select(lambda x: not x.is_draft())[0]
-    formdata.formdef.digest_template = 'digest of number {{form_number}}'
+    formdata.formdef.digest_template = 'digest of number <{{form_number}}>'
     formdata.store()
     assert formdata.get(formdata.id).digest
     resp = app.get('/backoffice/management/listing')
     assert formdata.get_url(backoffice=True) in resp.body
-    assert formdata.digest in resp.body
+    assert 'digest of number &lt;%s&gt;' % formdata.id_display in resp.body
 
     # check a Channel column is added when welco is available
     assert not 'Channel' in resp.body

wcs/formdata.py

@@ -394,7 +394,7 @@ class FormData(StorableObject):
                 if template is None:
                     new_value = None
                 else:
-                    new_value = Template(template).render(context)
+                    new_value = Template(template, autoescape=False).render(context)
                 if new_value != getattr(self, attribute, None):
                     setattr(self, attribute, new_value)
                     changed = True