diff --git a/apps/activity/tables.py b/apps/activity/tables.py index a3189a79..2d8e5dcc 100644 --- a/apps/activity/tables.py +++ b/apps/activity/tables.py @@ -1,7 +1,9 @@ # Copyright (C) 2018-2021 by BDE ENS Paris-Saclay # SPDX-License-Identifier: GPL-3.0-or-later + from django.utils import timezone -from django.utils.html import format_html +from django.utils.html import escape +from django.utils.safestring import mark_safe from django.utils.translation import gettext_lazy as _ import django_tables2 as tables from django_tables2 import A @@ -52,8 +54,8 @@ class GuestTable(tables.Table): def render_entry(self, record): if record.has_entry: return str(_("Entered on ") + str(_("{:%Y-%m-%d %H:%M:%S}").format(record.entry.time, ))) - return format_html(''.format(id=record.id, delete_trans=_("remove").capitalize())) + return mark_safe(''.format(id=record.id, delete_trans=_("remove").capitalize())) def get_row_class(record): @@ -91,7 +93,7 @@ class EntryTable(tables.Table): if hasattr(record, 'username'): username = record.username if username != value: - return format_html(value + " aka. " + username) + return mark_safe(escape(value) + " aka. " + escape(username)) return value def render_balance(self, value): diff --git a/apps/note/templates/note/transaction_form.html b/apps/note/templates/note/transaction_form.html index dc5afbda..bdf047a5 100644 --- a/apps/note/templates/note/transaction_form.html +++ b/apps/note/templates/note/transaction_form.html @@ -10,21 +10,25 @@ SPDX-License-Identifier: GPL-2.0-or-later {# bandeau transfert/crédit/débit/activité #}
-