From c81acab7e01fb697db8970c1a4fd6d23707eec6a Mon Sep 17 00:00:00 2001
From: Tom Christie <tom@tomchristie.com>
Date: Tue, 27 Oct 2015 14:21:03 +0000
Subject: [PATCH] Use format_html in simple_tag functions

---
 rest_framework/templatetags/rest_framework.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rest_framework/templatetags/rest_framework.py b/rest_framework/templatetags/rest_framework.py
index efe46292d..a23be949b 100644
--- a/rest_framework/templatetags/rest_framework.py
+++ b/rest_framework/templatetags/rest_framework.py
@@ -41,8 +41,8 @@ def optional_login(request):
     except NoReverseMatch:
         return ''
 
-    snippet = "<li><a href='{href}?next={next}'>Log in</a></li>".format(href=login_url, next=escape(request.path))
-    return snippet
+    snippet = "<li><a href='{href}?next={next}'>Log in</a></li>"
+    return format_html(snippet, href=login_url, next=escape(request.path))
 
 
 @register.simple_tag
@@ -53,7 +53,8 @@ def optional_logout(request, user):
     try:
         logout_url = reverse('rest_framework:logout')
     except NoReverseMatch:
-        return '<li class="navbar-text">{user}</li>'.format(user=escape(user))
+        snippet = '<li class="navbar-text">{user}</li>'
+        return format_html(snippet, user=escape(user))
 
     snippet = """<li class="dropdown">
         <a href="#" class="dropdown-toggle" data-toggle="dropdown">
@@ -64,8 +65,7 @@ def optional_logout(request, user):
             <li><a href='{href}?next={next}'>Log out</a></li>
         </ul>
     </li>"""
-
-    return snippet.format(user=user, href=logout_url, next=escape(request.path))
+    return format_html(snippet, user=escape(user), href=logout_url, next=escape(request.path))
 
 
 @register.simple_tag