workflows: don't use django autoescaping in odt templates (#21446)

tests/test_form_pages.py

@@ -46,7 +46,8 @@ def assert_equal_zip(stream1, stream2):
     z2 = zipfile.ZipFile(stream2)
     assert set(z1.namelist()) == set(z2.namelist())
     for name in z1.namelist():
-        assert z1.read(name) == z2.read(name), 'file "%s" differs' % name
+        t1, t2 = z1.read(name), z2.read(name)
+        assert t1 == t2, 'file "%s" differs' % name
 
 
 def pytest_generate_tests(metafunc):
@@ -2194,15 +2195,19 @@ def test_formdata_generated_document_download(pub):
     assert resp.click('test.rtf', index=2).follow().body == 'HELLO {{DJANGO}} WORLD {\\uc1{test}}'
 
 
-def test_formdata_generated_document_odt_download(pub):
+@pytest.fixture(params=['template.odt', 'template-django.odt'])
+def odt_template(request):
+    return request.param
+
+def test_formdata_generated_document_odt_download(pub, odt_template):
     create_user(pub)
     wf = Workflow(name='status')
     st1 = wf.add_status('Status1', 'st1')
     export_to = ExportToModel()
     export_to.label = 'create doc'
-    template_filename = os.path.join(os.path.dirname(__file__), 'template.odt')
+    template_filename = os.path.join(os.path.dirname(__file__), odt_template)
     template = open(template_filename).read()
-    upload = QuixoteUpload('/foo/template.odt', content_type='application/octet-stream')
+    upload = QuixoteUpload('/foo/' + odt_template, content_type='application/octet-stream')
     upload.fp = StringIO.StringIO()
     upload.fp.write(template)
     upload.fp.seek(0)
@@ -2256,8 +2261,8 @@ def test_formdata_generated_document_odt_download(pub):
     assert resp.location == form_location
     resp = resp.follow() # back to form page
 
-    resp = resp.click('template.odt')
-    assert resp.location.endswith('/template.odt')
+    resp = resp.click(odt_template)
+    assert resp.location.endswith('/' + odt_template)
     resp = resp.follow()
     assert resp.content_type == 'application/octet-stream'
     with open(os.path.join(os.path.dirname(__file__), 'template-out.odt')) as f:
@@ -2277,7 +2282,7 @@ def test_formdata_generated_document_odt_download(pub):
     resp = resp.follow() # back to form page
 
     with open(os.path.join(os.path.dirname(__file__), 'template-out.odt')) as f:
-        body = resp.click('template.odt', index=0).follow().body
+        body = resp.click(odt_template, index=0).follow().body
         assert_equal_zip(StringIO.StringIO(body), f)
     assert resp.click('test.rtf', index=0).follow().body == 'HELLO NEW WORLD'
 

tests/test_workflows.py

@@ -2526,6 +2526,48 @@ def test_export_to_model_backoffice_field(pub):
     item.perform(formdata)
     assert formdata.data == {}
 
+def test_export_to_model_django_template(pub):
+    formdef = FormDef()
+    formdef.name = 'foo-export-to-template-with-django'
+    formdef.fields = [
+        StringField(id='1', label='String', type='string', varname='string'),
+    ]
+    formdef.store()
+    formdata = formdef.data_class()()
+    formdata.data = {}
+    formdata.just_created()
+    formdata.store()
+    pub.substitutions.feed(formdata)
+
+    item = ExportToModel()
+    item.method = 'non-interactive'
+    item.attach_to_history = True
+    template_filename = os.path.join(os.path.dirname(__file__), 'template-django.odt')
+    template = open(template_filename).read()
+    upload = QuixoteUpload('/foo/template-django.odt', content_type='application/octet-stream')
+    upload.fp = StringIO.StringIO()
+    upload.fp.write(template)
+    upload.fp.seek(0)
+    item.model_file = UploadedFile(pub.app_dir, None, upload)
+    item.perform(formdata)
+
+    new_content = zipfile.ZipFile(open(formdata.evolution[0].parts[0].filename)).read('content.xml')
+    assert '>foo-export-to-template-with-django<' in new_content
+
+    formdef.name = 'Name with a \' simple quote'
+    formdef.store()
+    item.perform(formdata)
+
+    new_content = zipfile.ZipFile(open(formdata.evolution[0].parts[1].filename)).read('content.xml')
+    assert '>Name with a \' simple quote<' in new_content
+
+    formdef.name = 'A <> name'
+    formdef.store()
+    item.perform(formdata)
+
+    new_content = zipfile.ZipFile(open(formdata.evolution[0].parts[2].filename)).read('content.xml')
+    assert '>A &lt;&gt; name<' in new_content
+
 def test_global_timeouts(pub):
     FormDef.wipe()
     Workflow.wipe()

wcs/wf/export_to_model.py

@@ -422,7 +422,7 @@ class ExportToModel(WorkflowStatusItem):
             def process_text(t):
                 if isinstance(t, unicode):
                     t = t.encode(get_publisher().site_charset)
-                t = template_on_context(context, t)
+                t = template_on_context(context, t, autoescape=False)
                 return unicode(t, get_publisher().site_charset)
             for node in root.iter():
                 got_blank_lines = False