CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-11 10:57:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Escape HTML arguments to translation strings (#6399)

Browse Source
This commit is contained in:
Raphael Michel
2026-07-20 13:15:09 +02:00
committed by GitHub
parent 09aef94376
commit ea819530f9
3 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/base/context.py
+12 -9
View File
@@ -23,6 +23,7 @@ import sys
from django.conf import settings
from django.urls import reverse
from django.utils.html import escape, format_html
from django.utils.safestring import mark_safe
from django.utils.translation import gettext
@@ -35,21 +36,23 @@ def get_powered_by(request, safelink=True):
d = gs.settings.license_check_input
if d.get('poweredby_name'):
if d.get('poweredby_url'):
msg = gettext('<a {a_name_attr}>powered by {name}</a> <a {a_attr}>based on pretix</a>').format(
msg = format_html(
gettext('<a {a_name_attr}>powered by {name}</a> <a {a_attr}>based on pretix</a>'),
name=d['poweredby_name'],
a_name_attr='href="{}" target="_blank" rel="noopener"'.format(
sl(d['poweredby_url']) if safelink else d['poweredby_url'],
),
a_attr='href="{}" target="_blank" rel="noopener"'.format(
a_name_attr=mark_safe('href="{}" target="_blank" rel="noopener"'.format(
escape(sl(d['poweredby_url'])) if safelink else escape(d['poweredby_url']),
)),
a_attr=mark_safe('href="{}" target="_blank" rel="noopener"'.format(
sl('https://pretix.eu') if safelink else 'https://pretix.eu',
)
))
)
else:
msg = gettext('<a {a_attr}>powered by {name} based on pretix</a>').format(
msg = format_html(
gettext('<a {a_attr}>powered by {name} based on pretix</a>'),
name=d['poweredby_name'],
a_attr='href="{}" target="_blank" rel="noopener"'.format(
a_attr=mark_safe('href="{}" target="_blank" rel="noopener"'.format(
sl('https://pretix.eu') if safelink else 'https://pretix.eu',
)
))
)
else:
msg = gettext('<a %(a_attr)s>ticketing powered by pretix</a>') % {
src/pretix/plugins/paypal/payment.py
+4 -2
View File
@@ -44,6 +44,7 @@ from django.contrib import messages
from django.http import HttpRequest
from django.template.loader import get_template
from django.urls import reverse
from django.utils.html import format_html
from django.utils.timezone import now
from django.utils.translation import gettext as __, gettext_lazy as _
from i18nfield.strings import LazyI18nString
@@ -112,9 +113,10 @@ class Paypal(BasePaymentProvider):
label=_('Client ID'),
max_length=80,
min_length=80,
help_text=_('<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>').format(
help_text=format_html(
'<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>',
text=_('Click here for a tutorial on how to obtain the required keys'),
docs_url='https://docs.pretix.eu/en/latest/user/payments/paypal.html'
docs_url='https://docs.pretix.eu/en/latest/user/payments/paypal.html',
)
)),
('secret',
src/pretix/plugins/paypal2/payment.py
+3 -1
View File
@@ -36,6 +36,7 @@ from django.template.loader import get_template
from django.templatetags.static import static
from django.urls import resolve, reverse
from django.utils.crypto import get_random_string
from django.utils.html import format_html
from django.utils.safestring import mark_safe
from django.utils.timezone import now
from django.utils.translation import gettext as __, gettext_lazy as _
@@ -110,7 +111,8 @@ class PaypalSettingsHolder(BasePaymentProvider):
label=_('Client ID'),
max_length=80,
min_length=80,
help_text=_('<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>').format(
help_text=format_html(
'<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>',
text=_('Click here for a tutorial on how to obtain the required keys'),
docs_url='https://docs.pretix.eu/en/latest/user/payments/paypal.html'
)