فهرست منبع

Fixed #20650 -- Fixed {% filter %} incorrectly accepting 'escape' as argument

Thanks to grzesiof for the report and to loic84 and Alex Gaynor
for the review.
Baptiste Mispelon 11 سال پیش
والد
کامیت
ec371ace00
3فایلهای تغییر یافته به همراه8 افزوده شده و 2 حذف شده
  1. 1 0
      django/template/base.py
  2. 3 2
      django/template/defaulttags.py
  3. 4 0
      tests/template_tests/tests.py

+ 1 - 0
django/template/base.py

@@ -1101,6 +1101,7 @@ class Library(object):
                     # for decorators that need it e.g. stringfilter
                     if hasattr(filter_func, "_decorated_function"):
                         setattr(filter_func._decorated_function, attr, value)
+            filter_func._filter_name = name
             return filter_func
         else:
             raise InvalidTemplateLibrary("Unsupported arguments to "

+ 3 - 2
django/template/defaulttags.py

@@ -665,8 +665,9 @@ def do_filter(parser, token):
     _, rest = token.contents.split(None, 1)
     filter_expr = parser.compile_filter("var|%s" % (rest))
     for func, unused in filter_expr.filters:
-        if getattr(func, '_decorated_function', func).__name__ in ('escape', 'safe'):
-            raise TemplateSyntaxError('"filter %s" is not permitted.  Use the "autoescape" tag instead.' % func.__name__)
+        filter_name = getattr(func, '_filter_name', None)
+        if filter_name in ('escape', 'safe'):
+            raise TemplateSyntaxError('"filter %s" is not permitted.  Use the "autoescape" tag instead.' % filter_name)
     nodelist = parser.parse(('endfilter',))
     parser.delete_first_token()
     return FilterNode(filter_expr, nodelist)

+ 4 - 0
tests/template_tests/tests.py

@@ -854,6 +854,10 @@ class TemplateTests(TransRealMixin, TestCase):
             'filter02': ('{% filter upper %}django{% endfilter %}', {}, 'DJANGO'),
             'filter03': ('{% filter upper|lower %}django{% endfilter %}', {}, 'django'),
             'filter04': ('{% filter cut:remove %}djangospam{% endfilter %}', {'remove': 'spam'}, 'django'),
+            'filter05': ('{% filter safe %}fail{% endfilter %}', {}, template.TemplateSyntaxError),
+            'filter05bis': ('{% filter upper|safe %}fail{% endfilter %}', {}, template.TemplateSyntaxError),
+            'filter06': ('{% filter escape %}fail{% endfilter %}', {}, template.TemplateSyntaxError),
+            'filter06bis': ('{% filter upper|escape %}fail{% endfilter %}', {}, template.TemplateSyntaxError),
 
             ### FIRSTOF TAG ###########################################################
             'firstof01': ('{% firstof a b c %}', {'a':0,'b':0,'c':0}, ''),