encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-07-11 16:52:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

Escape username in optional_logout

Browse Source
This commit is contained in:
Tom Christie 2015-10-27 14:17:19 +00:00
parent 7661398a4a
commit fed691a304
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rest_framework/templatetags/rest_framework.py
View File

@ -53,7 +53,7 @@ def optional_logout(request, user):
try: try:
logout_url = reverse('rest_framework:logout') logout_url = reverse('rest_framework:logout')
except NoReverseMatch: except NoReverseMatch:
return '<li class="navbar-text">{user}</li>'.format(user=user) return '<li class="navbar-text">{user}</li>'.format(user=escape(user))
snippet = """<li class="dropdown"> snippet = """<li class="dropdown">
<a href="#" class="dropdown-toggle" data-toggle="dropdown"> <a href="#" class="dropdown-toggle" data-toggle="dropdown">