template_path=os.path.join(os.path.dirname(__file__), "templates"),
static_path=os.path.join(os.path.dirname(__file__), "static"),
xsrf_cookies=True,
+ autoescape="xhtml_escape",
)
tornado.web.Application.__init__(self, handlers, **settings)
</head>
<body>
<div id="nav">
- <b>{{ escape(current_user["name"]) }}</b> -
+ <b>{{ current_user["name"] }}</b> -
<a href="/auth/logout">{{ _("Sign out") }}</a>
</div>
<div id="body">
<td style="padding-left:5px">
<input type="submit" value="{{ _("Post") }}"/>
<input type="hidden" name="next" value="{{ request.path }}"/>
- {{ xsrf_form_html() }}
+ {% raw xsrf_form_html() %}
</td>
</tr>
</table>
if not getattr(RequestHandler, "_templates", None):
RequestHandler._templates = {}
if template_path not in RequestHandler._templates:
- loader = self.application.settings.get("template_loader") or\
- template.Loader(template_path)
+ loader = self.create_template_loader(template_path)
RequestHandler._templates[template_path] = loader
t = RequestHandler._templates[template_path].load(template_name)
args = dict(
args.update(kwargs)
return t.generate(**args)
+ def create_template_loader(self, template_path):
+ settings = self.application.settings
+ if "template_loader" in settings:
+ return settings["template_loader"]
+ kwargs = {}
+ if "autoescape" in settings:
+ # autoescape=None means "no escaping", so we have to be sure
+ # to only pass this kwarg if the user asked for it.
+ kwargs["autoescape"] = settings["autoescape"]
+ return template.Loader(template_path, **kwargs)
+
+
def flush(self, include_footers=False):
"""Flushes the current output buffer to the network."""
if self.application._wsgi:
projects / thirdparty / tornado.git / commitdiff
