adds mark_safe to the render_form method on the structblock (#5687)

CHANGELOG.txt

@@ -15,6 +15,7 @@ Changelog
  * Fix: Unbundle the l18n library as it was bundled to avoid installation errors which have been resolved (Matt Westcott)
  * Fix: Prevent error when comparing pages that reference a model with a custom primary key (Fidel Ramos)
  * Fix: Moved ``get_document_model`` location so it can be imported when Models are not yet loaded (WinterComes)
+ * Fix: Fixed incorrect HTML escaping of Jinja2 form templates for StructBlocks (Brady Moe)
 
 2.7 LTS (06.11.2019)
 ~~~~~~~~~~~~~~~~~~~~

docs/releases/2.8.rst

@@ -29,6 +29,7 @@ Bug fixes
  * Unbundle the l18n library as it was bundled to avoid installation errors which have been resolved (Matt Westcott)
  * Prevent error when comparing pages that reference a model with a custom primary key (Fidel Ramos)
  * Moved ``get_document_model`` location so it can be imported when Models are not yet loaded (WinterComes)
+ * Fixed incorrect HTML escaping of Jinja2 form templates for StructBlocks (Brady Moe)
 
 
 Upgrade considerations

wagtail/core/blocks/struct_block.py

@@ -6,6 +6,7 @@ from django.forms.utils import ErrorList
 from django.template.loader import render_to_string
 from django.utils.functional import cached_property
 from django.utils.html import format_html, format_html_join
+from django.utils.safestring import mark_safe
 
 from wagtail.admin.staticfiles import versioned_static
 
@@ -106,7 +107,7 @@ class BaseStructBlock(Block):
     def render_form(self, value, prefix='', errors=None):
         context = self.get_form_context(value, prefix=prefix, errors=errors)
 
-        return render_to_string(self.meta.form_template, context)
+        return mark_safe(render_to_string(self.meta.form_template, context))
 
     def value_from_datadict(self, data, files, prefix):
         return self._to_struct_value([

wagtail/core/tests/test_blocks.py

@@ -13,7 +13,7 @@ from django.forms.utils import ErrorList
 from django.template.loader import render_to_string
 from django.test import SimpleTestCase, TestCase
 from django.utils.html import format_html
-from django.utils.safestring import SafeData, mark_safe
+from django.utils.safestring import SafeData, SafeText, mark_safe
 from django.utils.translation import ugettext_lazy as __
 
 from wagtail.core import blocks
@@ -1214,6 +1214,42 @@ class TestStructBlock(SimpleTestCase):
         )
         self.assertNotIn('<li class="required">', html)
 
+    def test_custom_render_form_template(self):
+        class LinkBlock(blocks.StructBlock):
+            title = blocks.CharBlock(required=False)
+            link = blocks.URLBlock(required=False)
+
+            class Meta:
+                form_template = 'tests/block_forms/struct_block_form_template.html'
+
+        block = LinkBlock()
+        html = block.render_form(block.to_python({
+            'title': "Wagtail site",
+            'link': 'http://www.wagtail.io',
+        }), prefix='mylink')
+
+        self.assertIn('<div>Hello</div>', html)
+        self.assertHTMLEqual('<div>Hello</div>', html)
+        self.assertTrue(isinstance(html, SafeText))
+
+    def test_custom_render_form_template_jinja(self):
+        class LinkBlock(blocks.StructBlock):
+            title = blocks.CharBlock(required=False)
+            link = blocks.URLBlock(required=False)
+
+            class Meta:
+                form_template = 'tests/jinja2/struct_block_form_template.html'
+
+        block = LinkBlock()
+        html = block.render_form(block.to_python({
+            'title': "Wagtail site",
+            'link': 'http://www.wagtail.io',
+        }), prefix='mylink')
+
+        self.assertIn('<div>Hello</div>', html)
+        self.assertHTMLEqual('<div>Hello</div>', html)
+        self.assertTrue(isinstance(html, SafeText))
+
     def test_render_required_field_indicator(self):
         class LinkBlock(blocks.StructBlock):
             title = blocks.CharBlock()

wagtail/tests/testapp/jinja2_templates/tests/jinja2/struct_block_form_template.html

@@ -0,0 +1 @@
+<div>Hello</div>

wagtail/tests/testapp/templates/tests/block_forms/struct_block_form_template.html

@@ -0,0 +1 @@
+<div>Hello</div>