Django 模板过滤器转义

Question

我有一个自定义过滤器，它接受一个字符串并将其变成我正在使用的工具提示库的适当属性。它适用于 OpenTip，但我正在转换为使用 Bootstrap.

中的工具提示库

这是我的过滤器：

from django import template
from django.utils.html import conditional_escape
from django.utils.safestring import mark_safe

register = template.Library()


@register.filter(needs_autoescape=False, is_safe=True)
def tooltip(value, autoescape=False):
    """
        Filter to turn some text into the tag that the tooltip library uses -
        Written as a filter so we can switch from one tooltip library to
        another
    """
    if autoescape:
        esc = conditional_escape
    else:
        esc = lambda x: x
    if value is not None and len(value) > 0:
        retval = 'data-toggle="tooltip" data-html="true" ' +\
            'rel="tooltip" title="%s"' % esc(value)
        return mark_safe(retval)
    else:
        return ''

这是我在模板中使用它的地方：

<form id="filter" name="filter" method="post"
class="form-inline">
{% csrf_token %}
    <label for="filterText">Filter Query:</label>
    <input type="text" id="current_filter" name="current_filter" value="{{current_filter}}" placeholder="Filter" class="span8"/>
    <i class="icon-question-sign"
    {{"Filters -<br>requester: [[first] [last]]|[windows_id]<br>client: [[first] [last]]|[windows_id]<br>approver:  [[first] [last]]|[windows_id]<br>worker: [[first] [last]]|[windows_id]<br>ticket: [id]<br>status: [open]|[closed]|[hold]<br>type: [termination]|[extension]|[access]|[password]|baskets]<br>item: [name for category/item/attribute inventory]<br>since: [mm/dd/yyyy]|[yyyy-mm-dd]<br>before: [mm/dd/yyyy]|[yyyy-mm-dd]<br>All searchs are AND with comma delimiting"|tooltip}}></i>
    <input type="submit" name="btnSubmit" class="btn" value="Filter"/>
    <input id="filter_reset" type="button" name="filter_reset" class="btn" value="Clear existing filters"/>
</form>
{% endif %}

但工具提示未处理 html，当我进入 Firebug 并剪切并粘贴 html 时，尽管我用 mark_safe:

标记的事实

<form class="form-inline" method="post" name="filter" id="filter">
<input type="hidden" value="dpuAc9GNUQtvGG5wYzrWsG2Vpu5i7PWJ" name="csrfmiddlewaretoken">
    <label for="filterText">Filter Query:</label>
    <input type="text" class="span8" placeholder="Filter" value="" name="current_filter" id="current_filter">
    <i title="Filters -&lt;br&gt;requester: [[first] [last]]|[windows_id]&lt;br&gt;client: [[first] [last]]|[windows_id]&lt;br&gt;approver:  [[first] [last]]|[windows_id]&lt;br&gt;worker: [[first] [last]]|[windows_id]&lt;br&gt;ticket: [id]&lt;br&gt;status: [open]|[closed]|[hold]&lt;br&gt;type: [termination]|[extension]|[access]|[password]|baskets]&lt;br&gt;item: [name for category/item/attribute inventory]&lt;br&gt;since: [mm/dd/yyyy]|[yyyy-mm-dd]&lt;br&gt;before: [mm/dd/yyyy]|[yyyy-mm-dd]&lt;br&gt;All searchs are AND with comma delimiting" rel="tooltip" data-html="true" data-toggle="tooltip" class="icon-question-sign">
    </i>
    <input type="submit" value="Filter" class="btn" name="btnSubmit">
    <input type="button" value="Clear existing filters" class="btn" name="filter_reset" id="filter_reset">
</form>

如何在不转义的情况下将过滤器文本中的 html 放入页面？

Answer 1

尝试使用 safe:

{{"Filters -<br>requester: [[first] [last]]|[windows_id]<br>client: [[first] [last]]|[windows_id]<br>approver:  [[first] [last]]|[windows_id]<br>worker: [[first] [last]]|[windows_id]<br>ticket: [id]<br>status: [open]|[closed]|[hold]<br>type: [termination]|[extension]|[access]|[password]|baskets]<br>item: [name for category/item/attribute inventory]<br>since: [mm/dd/yyyy]|[yyyy-mm-dd]<br>before: [mm/dd/yyyy]|[yyyy-mm-dd]<br>All searchs are AND with comma delimiting"|safe|tooltip}}

或者您可以尝试从 tooltip 标签中删除 esc。

编辑：

我刚刚意识到你想做什么。 ~~您不能将 html 放在 tooltip in bootstrap, it's a plaintext feature only~~. data-html="true" allows it to contain html content. You can also use popover 中。 safe 以上过滤器仍应使用以禁用 html 转义。

Answer 2

事实证明问题比我想象的要愚蠢得多 - 我的 <script> 标签顺序错误所以我得到的是 jQuery-UI 工具提示Bootstrap 工具提示，jQuery-UI 工具提示不支持 html.

Django 模板过滤器转义

Django template filter escaping

django

django-templates