]> git.ipfire.org Git - thirdparty/tornado.git/commitdiff
Use autoescape in appengine blog demo.
authorBen Darnell <ben@bendarnell.com>
Sun, 3 Mar 2013 16:54:35 +0000 (11:54 -0500)
committerBen Darnell <ben@bendarnell.com>
Sun, 3 Mar 2013 16:54:35 +0000 (11:54 -0500)
demos/appengine/blog.py
demos/appengine/templates/archive.html
demos/appengine/templates/base.html
demos/appengine/templates/compose.html
demos/appengine/templates/entry.html
demos/appengine/templates/feed.xml
demos/appengine/templates/home.html
demos/appengine/templates/modules/entry.html

index 6caba53113a3b6de30a824160969e15c3f0408ba..546586391737892210edb7fa5f7631fc5a1dcda8 100644 (file)
@@ -152,7 +152,6 @@ settings = {
     "template_path": os.path.join(os.path.dirname(__file__), "templates"),
     "ui_modules": {"Entry": EntryModule},
     "xsrf_cookies": True,
-    "autoescape": None,
 }
 application = tornado.wsgi.WSGIApplication([
     (r"/", HomeHandler),
index dcca9511a48919ec28579363ad803d654298672a..d5014649768648f0d0996d12305ecf209d3d1380 100644 (file)
@@ -23,7 +23,7 @@
   <ul class="archive">
     {% for entry in entries %}
       <li>
-        <div class="title"><a href="/entry/{{ entry.slug }}">{{ escape(entry.title) }}</a></div>
+        <div class="title"><a href="/entry/{{ entry.slug }}">{{ entry.title }}</a></div>
         <div class="date">{{ locale.format_date(entry.published, full_format=True, shorter=True) }}</div>
       </li>
     {% end %}
index 0154aea8ca5d537472f354e57e8faf41f92a153b..2030ab63af25e64f56b7fc90b1e4063ae6ddec15 100644 (file)
@@ -1,10 +1,10 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
-    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> 
-    <title>{{ escape(handler.settings["blog_title"]) }}</title>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+    <title>{{ handler.settings["blog_title"] }}</title>
     <link rel="stylesheet" href="/static/blog.css" type="text/css"/>
-    <link rel="alternate" href="/feed" type="application/atom+xml" title="{{ escape(handler.settings["blog_title"]) }}"/>
+    <link rel="alternate" href="/feed" type="application/atom+xml" title="{{ handler.settings["blog_title"] }}"/>
     {% block head %}{% end %}
   </head>
   <body>
       <div id="header">
         <div style="float:right">
           {% if not current_user %}
-            {{ _('<a href="%(url)s">Sign in</a> to compose/edit') % {"url": escape(users.create_login_url(request.uri))} }}
+            {% raw _('<a href="%(url)s">Sign in</a> to compose/edit') % {"url": escape(users.create_login_url(request.uri))} %}
           {% else %}
             {% if current_user.administrator %}
               <a href="/compose">{{ _("New post") }}</a> -
             {% end %}
-            <a href="{{ escape(users.create_logout_url(request.uri)) }}">{{ _("Sign out") }}</a>
+            <a href="{{ users.create_logout_url(request.uri) }}">{{ _("Sign out") }}</a>
           {% end %}
         </div>
-        <h1><a href="/">{{ escape(handler.settings["blog_title"]) }}</a></h1>
+        <h1><a href="/">{{ handler.settings["blog_title"] }}</a></h1>
       </div>
       <div id="content">{% block body %}{% end %}</div>
     </div>
index 7e831aaa9b37490978f002b1a9b73b9bc116bdf7..39045e0394c11205957929a0bd22413a6a291877 100644 (file)
@@ -2,8 +2,8 @@
 
 {% block body %}
   <form action="{{ request.path }}" method="post" class="compose">
-    <div style="margin-bottom:5px"><input name="title" type="text" class="title" value="{{ escape(entry.title) if entry else "" }}"/></div>
-    <div style="margin-bottom:5px"><textarea name="body_source" rows="30" cols="40" class="body_source">{{ escape(entry.body_source) if entry else "" }}</textarea></div>
+    <div style="margin-bottom:5px"><input name="title" type="text" class="title" value="{{ entry.title if entry else "" }}"/></div>
+    <div style="margin-bottom:5px"><textarea name="body_source" rows="30" cols="40" class="body_source">{{ entry.body_source if entry else "" }}</textarea></div>
     <div>
       <input type="submit" value="{{ _("Save changes") if entry else _("Publish post") }}" class="submit"/>
       &nbsp;<a href="{{ "/entry/" + entry.slug if entry else "/" }}">{{ _("Cancel") }}</a>
@@ -11,7 +11,7 @@
     {% if entry %}
       <input type="hidden" name="key" value="{{ str(entry.key()) }}"/>
     {% end %}
-    {{ xsrf_form_html() }}
+    {% module xsrf_form_html() %}
   </form>
 {% end %}
 
index 43c835deadad689961480e50f0863e2477b449a5..f3f495b4968741d06231d8819189b5f181c5cf62 100644 (file)
@@ -1,5 +1,5 @@
 {% extends "base.html" %}
 
 {% block body %}
-  {{ modules.Entry(entry) }}
+  {% module Entry(entry) %}
 {% end %}
index c6c368656c70ee69d41d04a1351c841aa466023a..a98826c8d302376fa3a79be57911c7d4c31286a9 100644 (file)
@@ -1,25 +1,25 @@
 <?xml version="1.0" encoding="utf-8"?>
 <feed xmlns="http://www.w3.org/2005/Atom">
   {% set date_format = "%Y-%m-%dT%H:%M:%SZ" %}
-  <title>{{ escape(handler.settings["blog_title"]) }}</title>
+  <title>{{ handler.settings["blog_title"] }}</title>
   {% if len(entries) > 0 %}
     <updated>{{ max(e.updated for e in entries).strftime(date_format) }}</updated>
   {% else %}
     <updated>{{ datetime.datetime.utcnow().strftime(date_format) }}</updated>
   {% end %}
   <id>http://{{ request.host }}/</id>
-  <link rel="alternate" href="http://{{ request.host }}/" title="{{ escape(handler.settings["blog_title"]) }}" type="text/html"/>
-  <link rel="self" href="{{ request.full_url() }}" title="{{ escape(handler.settings["blog_title"]) }}" type="application/atom+xml"/>
-  <author><name>{{ escape(handler.settings["blog_title"]) }}</name></author>
+  <link rel="alternate" href="http://{{ request.host }}/" title="{{ handler.settings["blog_title"] }}" type="text/html"/>
+  <link rel="self" href="{{ request.full_url() }}" title="{{ handler.settings["blog_title"] }}" type="application/atom+xml"/>
+  <author><name>{{ handler.settings["blog_title"] }}</name></author>
   {% for entry in entries %}
     <entry>
       <id>http://{{ request.host }}/entry/{{ entry.slug }}</id>
-      <title type="text">{{ escape(entry.title) }}</title>
+      <title type="text">{{ entry.title }}</title>
       <link href="http://{{ request.host }}/entry/{{ entry.slug }}" rel="alternate" type="text/html"/>
       <updated>{{ entry.updated.strftime(date_format) }}</updated>
       <published>{{ entry.published.strftime(date_format) }}</published>
       <content type="xhtml" xml:base="http://{{ request.host }}/">
-        <div xmlns="http://www.w3.org/1999/xhtml">{{ entry.html }}</div>
+        <div xmlns="http://www.w3.org/1999/xhtml">{% raw entry.html %}</div>
       </content>
     </entry>
   {% end %}
index dd069a97f3f3861b6f1125342e4d4b2fe094a765..8e990ca56cb1beac63d95fcf63411469fcc998ac 100644 (file)
@@ -2,7 +2,7 @@
 
 {% block body %}
   {% for entry in entries %}
-    {{ modules.Entry(entry) }}
+    {% module Entry(entry) %}
   {% end %}
   <div><a href="/archive">{{ _("Archive") }}</a></div>
 {% end %}
index 06237657c8677f0ef7cb2b904e0badc803caeeb0..201c04118c4bc56929e518052797fe5925f2dcea 100644 (file)
@@ -1,7 +1,7 @@
 <div class="entry">
-  <h1><a href="/entry/{{ entry.slug }}">{{ escape(entry.title) }}</a></h1>
+  <h1><a href="/entry/{{ entry.slug }}">{{ entry.title }}</a></h1>
   <div class="date">{{ locale.format_date(entry.published, full_format=True, shorter=True) }}</div>
-  <div class="body">{{ entry.html }}</div>
+  <div class="body">{% raw entry.html %}</div>
   {% if current_user and current_user.administrator %}
     <div class="admin"><a href="/compose?key={{ str(entry.key()) }}">{{ _("Edit this post") }}</a></div>
   {% end %}