From 8ec1b83d25c8a9496675c716d03dbd7e5d02ac51 Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Fri, 3 Jul 2026 14:02:22 +0200 Subject: [PATCH] Use SafeStrings for plugin signals returning HTML that should be rendered --- src/pretix/base/templatetags/eventsignal.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/pretix/base/templatetags/eventsignal.py b/src/pretix/base/templatetags/eventsignal.py index 54f2da5df..f2e0ec2f4 100644 --- a/src/pretix/base/templatetags/eventsignal.py +++ b/src/pretix/base/templatetags/eventsignal.py @@ -22,6 +22,7 @@ import importlib from django import template +from django.utils.html import conditional_escape from django.utils.safestring import mark_safe from pretix.base.models import Event @@ -44,7 +45,7 @@ def eventsignal(event: Event, signame: str, **kwargs): _html = [] for receiver, response in signal.send(event, **kwargs): if response: - _html.append(response) + _html.append(conditional_escape(response)) return mark_safe("".join(_html)) @@ -63,5 +64,5 @@ def signal(signame: str, request, **kwargs): _html = [] for receiver, response in signal.send(request, **kwargs): if response: - _html.append(response) + _html.append(conditional_escape(response)) return mark_safe("".join(_html))