From c5d98d93beede60aad67f86608f316eff0ef28b5 Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Thu, 9 Jul 2026 17:53:07 +0200 Subject: [PATCH] Use format_html in dashboard widgets --- .../templates/pretixcontrol/dashboard.html | 10 +++--- .../templates/pretixcontrol/event/index.html | 6 ++-- src/pretix/control/views/dashboards.py | 33 ++++++++++--------- 3 files changed, 26 insertions(+), 23 deletions(-) diff --git a/src/pretix/control/templates/pretixcontrol/dashboard.html b/src/pretix/control/templates/pretixcontrol/dashboard.html index 7dace39370..cfc2a90460 100644 --- a/src/pretix/control/templates/pretixcontrol/dashboard.html +++ b/src/pretix/control/templates/pretixcontrol/dashboard.html @@ -28,7 +28,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} @@ -51,7 +51,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} @@ -72,7 +72,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} @@ -94,7 +94,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} {% else %} @@ -102,7 +102,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} {% endif %} diff --git a/src/pretix/control/templates/pretixcontrol/event/index.html b/src/pretix/control/templates/pretixcontrol/event/index.html index f1fd140be9..a8d04040de 100644 --- a/src/pretix/control/templates/pretixcontrol/event/index.html +++ b/src/pretix/control/templates/pretixcontrol/event/index.html @@ -106,7 +106,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} {% elif w.link %} @@ -114,7 +114,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} {% else %} @@ -122,7 +122,7 @@ {% if w.lazy %} {% else %} - {{ w.content|safe }} + {{ w.content }} {% endif %} {% endif %} diff --git a/src/pretix/control/views/dashboards.py b/src/pretix/control/views/dashboards.py index 02bddc9964..33f5d8489a 100644 --- a/src/pretix/control/views/dashboards.py +++ b/src/pretix/control/views/dashboards.py @@ -49,7 +49,7 @@ from django.shortcuts import render from django.template.loader import get_template from django.urls import reverse from django.utils.formats import date_format -from django.utils.html import escape +from django.utils.html import escape, format_html from django.utils.timezone import now from django.utils.translation import gettext_lazy as _, ngettext, pgettext @@ -112,7 +112,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs): return [ { - 'content': None if lazy else NUM_WIDGET.format(num=intcomma(tickc), text=_('Attendees (ordered)')), + 'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(tickc), text=_('Attendees (ordered)')), 'lazy': 'attendees-ordered', 'display_size': 'small', 'priority': 100, @@ -122,7 +122,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs): }) + ('?subevent={}'.format(subevent.pk) if subevent else '') }, { - 'content': None if lazy else NUM_WIDGET.format(num=intcomma(paidc), text=_('Attendees (paid)')), + 'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(paidc), text=_('Attendees (paid)')), 'lazy': 'attendees-paid', 'display_size': 'small', 'priority': 100, @@ -132,7 +132,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs): }) + ('?subevent={}'.format(subevent.pk) if subevent else '') }, { - 'content': None if lazy else NUM_WIDGET.format( + 'content': None if lazy else format_html(NUM_WIDGET, num=money_filter(round_decimal(rev, sender.currency), sender.currency, hide_currency=True), text=_('Total revenue ({currency})').format(currency=sender.currency) ), @@ -145,7 +145,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs): }) + ('?subevent={}'.format(subevent.pk) if subevent else '') }, { - 'content': None if lazy else NUM_WIDGET.format(num=prodc, text=_('Active products')), + 'content': None if lazy else format_html(NUM_WIDGET, num=prodc, text=_('Active products')), 'lazy': 'active-products', 'display_size': 'small', 'priority': 100, @@ -209,7 +209,7 @@ def waitinglist_widgets(sender, subevent=None, lazy=False, **kwargs): quota_cache[q.pk] = (quota_cache[q.pk][0], quota_cache[q.pk][1] - min(wlt['cnt'], row[1])) widgets.append({ - 'content': None if lazy else NUM_WIDGET.format( + 'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(happy), text=_('available to give to people on waiting list') ), 'lazy': 'waitinglist-avail', @@ -220,7 +220,7 @@ def waitinglist_widgets(sender, subevent=None, lazy=False, **kwargs): }) }) widgets.append({ - 'content': None if lazy else NUM_WIDGET.format(num=intcomma(wles.count()), text=_('total waiting list length')), + 'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(wles.count()), text=_('total waiting list length')), 'lazy': 'waitinglist-length', 'display_size': 'small', 'priority': 50, @@ -247,7 +247,7 @@ def quota_widgets(sender, subevent=None, lazy=False, **kwargs): if not lazy: status, left = qa.results[q] if q in qa.results else q.availability(allow_cache=True) widgets.append({ - 'content': None if lazy else NUM_WIDGET.format( + 'content': None if lazy else format_html(NUM_WIDGET, num='{}/{}'.format(intcomma(left), intcomma(q.size)) if q.size is not None else '\u221e', text=_('{quota} left').format(quota=escape(q.name)) ), @@ -268,7 +268,8 @@ def shop_state_widget(sender, **kwargs): return [{ 'display_size': 'small', 'priority': 1000, - 'content': '
{t1}
{state}{t2}
'.format( + 'content': format_html( + '
{t1}
{state}{t2}
', t1=_('Your ticket shop is'), t2=_('Click here to change'), state=_('live') if sender.live and not sender.testmode else ( _('live and in test mode') if sender.live else ( @@ -299,7 +300,7 @@ def checkin_widget(sender, subevent=None, lazy=False, **kwargs): qs = sender.checkin_lists.filter(subevent=subevent) for cl in qs: widgets.append({ - 'content': None if lazy else NUM_WIDGET.format( + 'content': None if lazy else format_html(NUM_WIDGET, num='{}/{}'.format(intcomma(cl.inside_count), intcomma(cl.position_count)), text=_('Present – {list}').format(list=escape(cl.name)) ), @@ -505,7 +506,7 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
{event}
{daterange}
-
{times}
+
{times}{timezone}
{orders} @@ -549,14 +550,15 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False): status = ('success', _('On sale')) widgets.append({ - 'content': tpl.format( + 'content': format_html(tpl, event=escape(event.name), times=_('Event series') if event.has_subevents else ( ((date_format(event.date_admission.astimezone(tz), 'TIME_FORMAT') + ' / ') if event.date_admission and event.date_admission != event.date_from else '') + (date_format(event.date_from.astimezone(tz), 'TIME_FORMAT') if event.date_from else '') - ) + ( - ' '.format(tzname) + ), + timezone=( + format_html(' ', tzname) if tzname != request.timezone and not event.has_subevents else '' ), url=reverse('control:event.index', kwargs={ @@ -564,7 +566,8 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False): 'organizer': event.organizer.slug }), orders=( - '{orders_text}'.format( + format_html( + '{orders_text}', orders_url=reverse('control:event.orders', kwargs={ 'event': event.slug, 'organizer': event.organizer.slug