Use the format_html utility. This will avoid any html from the parameters and mark the line as safe for use in templates. The allow_tags method allow_tags deprecated in Django 1.9.
from django.utils.html import format_html class MyModelAdmin(admin.ModelAdmin): list_display = ['show_url', ...] ... def show_url(self, obj): return format_html("<a href='http://pre.com{0}'>{0}</a>", obj.url)
Now your admin users are safe even in the case of:
url == '<script>eval(...);</script>'
See the documentation for more details.
Seppo ErviΓ€lΓ€ Jul 31 '15 at 12:23 2015-07-31 12:23
source share