Skip to content
This repository has been archived by the owner on Mar 26, 2021. It is now read-only.

HTML escape problems when using as tempate filter #26

Open
MacLake opened this issue Feb 12, 2016 · 1 comment
Open

HTML escape problems when using as tempate filter #26

MacLake opened this issue Feb 12, 2016 · 1 comment

Comments

@MacLake
Copy link

MacLake commented Feb 12, 2016

I’ve tried django-softhyphen as a template filter with Django 1.9.1, Python 3.4

When I leave autoescape on (the default), I get all the ­ escaped, so they are being displayed as ­ on the web page. So I have to turn off autoescape for the fields where want hyphenation, which might be a security problem, and causes problems when there are & or < in the text fields, which are then interpreted as HTML syntax. I had a company name with & and no space afterwards, which displayed as a funny special character. Putting a space after the & avoids this, but it’s still wrong HTML.

@derhedwig
Copy link

derhedwig commented Jun 6, 2016

Yeah, the templatetag needs to be wrapped in mark_safe:

from django.utils.safestring import mark_safe

@register.filter
def softhyphen(value, language=None):
    """
    Hyphenates html.
    """
    return mark_safe(hyphenate(value, language=language))

(Think about it, if that would actually be insecure...)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants