[Mpuls-commits] r1723 - in wasko/branches/2.0: . mpulsweb/lib

scm-commit@wald.intevation.org scm-commit at wald.intevation.org
Tue Feb 23 21:10:16 CET 2010


Author: bh
Date: 2010-02-23 21:10:15 +0100 (Tue, 23 Feb 2010)
New Revision: 1723

Modified:
   wasko/branches/2.0/ChangeLog
   wasko/branches/2.0/mpulsweb/lib/renderer.py
Log:
* mpulsweb/lib/renderer.py (tag): New function.  Create an opening
tag with attribute and proper quoting.
(ViewRenderer.next_tabindex): Just return the index as a string,
not the whole attribute=value string.
(ViewRenderer.render, ViewRenderer._renderLabel)
(ViewRenderer._renderAttributes, ViewRenderer._renderErrors)
(ViewRenderer._renderDummyLeaf, ViewRenderer._renderRepeatList)
(ViewRenderer._renderRepeatNav, ViewRenderer._renderInfo)
(ViewRenderer._renderText, ViewRenderer._renderDate)
(ViewRenderer._renderInt, ViewRenderer._renderTextArea)
(ViewRenderer._renderRadio, ViewRenderer._renderPlainBool)
(ViewRenderer._renderChoice, ViewRenderer._renderChoiceGroup)
(ViewRenderer._renderMatrix)
(ViewRenderer._renderExternalChoiceList)
(RepeatGroupRenderer.render_digest, RepeatGroupRenderer.render)
(ErrorRenderer.render): Use tag where useful and ensure proper
quoting.


Modified: wasko/branches/2.0/ChangeLog
===================================================================
--- wasko/branches/2.0/ChangeLog	2010-02-23 19:47:02 UTC (rev 1722)
+++ wasko/branches/2.0/ChangeLog	2010-02-23 20:10:15 UTC (rev 1723)
@@ -1,5 +1,27 @@
 2010-02-23  Bernhard Herzog  <bh at intevation.de>
 
+	Make the renderer quote texts properly:
+
+	* mpulsweb/lib/renderer.py (tag): New function.  Create an opening
+	tag with attribute and proper quoting.
+	(ViewRenderer.next_tabindex): Just return the index as a string,
+	not the whole attribute=value string.
+	(ViewRenderer.render, ViewRenderer._renderLabel)
+	(ViewRenderer._renderAttributes, ViewRenderer._renderErrors)
+	(ViewRenderer._renderDummyLeaf, ViewRenderer._renderRepeatList)
+	(ViewRenderer._renderRepeatNav, ViewRenderer._renderInfo)
+	(ViewRenderer._renderText, ViewRenderer._renderDate)
+	(ViewRenderer._renderInt, ViewRenderer._renderTextArea)
+	(ViewRenderer._renderRadio, ViewRenderer._renderPlainBool)
+	(ViewRenderer._renderChoice, ViewRenderer._renderChoiceGroup)
+	(ViewRenderer._renderMatrix)
+	(ViewRenderer._renderExternalChoiceList)
+	(RepeatGroupRenderer.render_digest, RepeatGroupRenderer.render)
+	(ErrorRenderer.render): Use tag where useful and ensure proper
+	quoting.
+
+2010-02-23  Bernhard Herzog  <bh at intevation.de>
+
 	* mpulsweb/lib/renderer.py: Remove some commented out code.
 
 2010-02-23  Bernhard Herzog  <bh at intevation.de>

Modified: wasko/branches/2.0/mpulsweb/lib/renderer.py
===================================================================
--- wasko/branches/2.0/mpulsweb/lib/renderer.py	2010-02-23 19:47:02 UTC (rev 1722)
+++ wasko/branches/2.0/mpulsweb/lib/renderer.py	2010-02-23 20:10:15 UTC (rev 1723)
@@ -48,7 +48,7 @@
 TARGET = re.compile(r"(\w+)(?:|:(.+))$")
 WEIGHTS = frozenset([15, 25, 30, 40, 45, 50, 55, 60, 75])
 #SET_MODIFICATION = 'onchange="setModification();"'
-SET_MODIFICATION = ''
+SET_MODIFICATION_ATTRS = {}
 
 def is_required(flags):
     return flags.find("required:") >= 0
@@ -69,6 +69,25 @@
     return depth
 
 
+def tag(tagname, _close=False, **attrs):
+    out = ["<%s" % tagname]
+    for name, value in attrs.items():
+        if name.endswith("_"):
+            name = name[:-1]
+        if isinstance(value, basestring):
+            out.append(" %s=%s" % (name, quoteattr(value)))
+        else:
+            if not value:
+                continue
+            else:
+                out.append(" " + name)
+    if _close:
+        out.append("/>")
+    else:
+        out.append(">")
+    return "".join(out)
+
+
 class Text:
 
     def __init__(self, txt):
@@ -139,10 +158,9 @@
     def next_tabindex(self):
         tabindex = self.tabindex
         self.tabindex += 1
-        return 'tabindex="%d"' % tabindex
+        return str(tabindex)
 
     def render(self, showNext=False):
-
         out = []
         if not self.ro_mode:
             out.append('<form id="formularpage"'
@@ -150,16 +168,17 @@
                        ' accept-charset="UTF-8" method="POST">\n')
             # Add submitbutton at the top of the page too
             out.append('<div class="widget formbuttons">')
-            out.append('<input type="submit" name="save" value="%s" %s>'
-                       % (_('Save'), self.next_tabindex()))
+            out.append(tag("input", type="submit", name="save",
+                           value=_('Save'), tabindex=self.next_tabindex()))
             if showNext:
-                out.append('&nbsp;<input type="submit" name="savenext"'
-                           ' value="%s" %s>'
-                           % (_('Save and proceed'), self.next_tabindex()))
+                out.append("&nbsp;")
+                out.append(tag("input", type="submit", name="savenext",
+                               value=_('Save and proceed'),
+                               tabindex=self.next_tabindex()))
             out.append('</div>')
         out.append('<div class="widget formfields">')
-        out.append('<input type="hidden" name="page" value="%s">'
-                   % (self.page.getIdentifier()))
+        out.append(tag("input", type="hidden", name="page",
+                       value=self.page.getIdentifier()))
 
         self.stateStack = []
         self.containersStack = [[Container(None)]]
@@ -170,12 +189,13 @@
         out.append('</div>')
         if not self.ro_mode:
             out.append('<div class="widget formbuttons">')
-            out.append('<input type="submit" name="save" value="%s" %s>'
-                       % (_('Save'), self.next_tabindex()))
+            out.append(tag("input", type="submit", name="save", value=_('Save'),
+                           tabindex=self.next_tabindex()))
             if showNext:
-                out.append('&nbsp;<input type="submit" name="savenext"'
-                           ' value="%s" %s>'
-                           % (_('Save and proceed'), self.next_tabindex()))
+                out.append("&nbsp;")
+                out.append(tag("input", type="submit", name="savenext",
+                               value=_('Save and proceed'),
+                               tabindex=self.next_tabindex()))
             out.append('</div>')
             out.append('</form>\n')
 
@@ -209,42 +229,51 @@
         out = []
         error = node.hasErrors() and "error" or ""
         if labeltag:
-            out.append('<label for="%s"><a class="%s" name="f_%s">'
-                       '%s</a></label>'
-                       % (node.getIdentifier(), error, node.getIdentifier(),
-                          meta.getDescription()))
+            out.append(tag("label", for_=node.getIdentifier()))
+            out.append(tag("a", class_=error,
+                           name="f_%s" % node.getIdentifier()))
+            out.append(escape(meta.getDescription()))
+            out.append("</a>")
+            out.append("</label>")
         else:
-            out.append('%s' %  meta.getDescription())
+            out.append(escape(meta.getDescription()))
         out.append(' ')
-        return "\n".join(out)
+        return "".join(out)
 
     def _renderAttributes(self, node):
         meta = self._getMeta(node)
 
         out = []
         if meta.hasHelp():
-            out.append('<a href="/annotations/help/%s" target="_blank">'
-                       '<img src="/images/icons/formular/help.png" alt="help">'
-                       '</a>'
-                       % meta.getName())
+            out.append(tag("a", href="/annotations/help/%s" % meta.getName(),
+                           target="_blank"))
+            out.append('<img src="/images/icons/formular/help.png" alt="help">')
+            out.append('</a>')
         if meta.hasRequired():
-            out.append('<a href="/annotations/required/%s" target="_blank">'
-                       '<img src="/images/icons/formular/required.png"'
-                       ' alt="required"></a>' % meta.getName())
+            out.append(tag("a",
+                           href="/annotations/required/%s" % meta.getName(),
+                           target="_blank"))
+            out.append('<img src="/images/icons/formular/required.png"'
+                       ' alt="required">')
+            out.append('</a>')
         if meta.hasEvaluation():
-            out.append('<a href="/annotations/evaluation/%s" target="_blank">'
-                       '<img src="/images/icons/formular/evaluation.png"'
-                       ' alt="evaluation"></a>' % meta.getName())
-        return "\n".join(out)
+            out.append(tag("a",
+                           href="/annotations/evaluation/%s" % meta.getName(),
+                           target="_blank"))
+            out.append('<img src="/images/icons/formular/evaluation.png"'
+                       ' alt="evaluation">')
+            out.append('</a>')
+        return "".join(out)
 
     def _renderErrors(self, node):
         meta = self._getMeta(node)
         out = []
-        error = '<form:error name="%s" format="">' % node.getIdentifier()
         if node.hasErrors() or True:
-            #out.append('<span class="error">%s</span>' % node.getErrors())
-            out.append('<span class="error">%s</span>' % error)
-        return "\n".join(out)
+            out.append('<span class="error">')
+            out.append(tag("form:error", name=node.getIdentifier(),
+                           format=""))
+            out.append('</span>')
+        return "".join(out)
 
     def _renderDummyGroup(self, node):
         meta = self._getMeta(node)
@@ -278,8 +307,7 @@
         out.append(self._renderLabel(node))
         out.append(self._renderAttributes(node))
         out.append('<br>')
-        out.append('<input name="%s" id="%s" value="%s" type="text">'
-                   % (name, name, data))
+        out.append(tag("input", name=name, id=name, value=data, type="text"))
         out.append('<br>')
         out.append(self._renderErrors(node))
         self.toTarget(Item("".join(out)), meta.getTarget())
@@ -327,23 +355,30 @@
             out.append('</td>')
             out.append('<td class="vcontrol" width="15">')
             if not self.ro_mode:
-                out.append('<a href="/repeatgroup/delete/%s">'
-                           '<img src="/images/icons/formular/rg_delete.png"'
-                           ' alt="%s"/></a>'
-                           % (child.getIdentifier(), _('Delete')))
+                out.append(tag("a", href=("/repeatgroup/delete/%s"
+                                          % child.getIdentifier())))
+                out.append(tag("img",
+                               src="/images/icons/formular/rg_delete.png",
+                               alt=_('Delete'), _close=True))
+                out.append('</a>')
             out.append('</td>')
             out.append('</tr>')
         if self.ro_mode:
             out.append('<tr><td class="hcontrol" style="text-align: right;"'
                        ' colspan="2">&nbsp;</td></tr>')
         else:
-            out.append('<tr><td class="hcontrol" style="text-align: right;"'
-                       ' colspan="2">'
-                       '<a href="/repeatgroup/new/%s">%s'
-                       ' <img src="/images/icons/formular/rg_new.png"'
-                       ' alt="%s"/></a></td></tr>'
-                       % (node.getIdentifier(), _('Create new'),
-                          _('Create new')))
+            out.append('<tr>')
+            out.append('<td class="hcontrol" style="text-align: right;"'
+                       ' colspan="2">')
+            out.append(tag("a",
+                           href="/repeatgroup/new/%s" % node.getIdentifier()))
+            out.append(escape(_('Create new')))
+            out.append(" ")
+            out.append(tag("img", src="/images/icons/formular/rg_new.png",
+                           alt=_('Create new'), _close=True))
+            out.append("</a>")
+            out.append("</td>")
+            out.append("</tr>")
         return out
 
     def _renderRepeatNav(self, node):
@@ -355,28 +390,44 @@
             out.append('</td>')
             out.append('</tr>')
             break
+
+        child_id = child.getIdentifier()
         out.append('<tr>')
         out.append('<td class="hcontrol">')
-        out.append('<a name="%s" href="/repeatgroup/select_first/%s">'
-                   '<img src="/images/icons/formular/rg_first.png"/></a>'
-                   % (_('Select first'), child.getIdentifier()))
-        out.append('<a name="%s" href="/repeatgroup/select_prev/%s">'
-                   '<img src="/images/icons/formular/rg_prev.png"/></a>'
-                   % (_('Select previous'), child.getIdentifier()))
-        out.append('<a name="%s" href="/repeatgroup/select_next/%s">'
-                   '<img src="/images/icons/formular/rg_next.png"/></a>'
-                   % (_('Select next'), child.getIdentifier()))
-        out.append('<a name="%s" href="/repeatgroup/select_last/%s">'
-                   '<img src="/images/icons/formular/rg_last.png"/></a>'
-                   % (_('Select last'), child.getIdentifier()))
+
+        out.append(tag("a", name=_('Select first'),
+                       href="/repeatgroup/select_first/%s" % child_id))
+        out.append('<img src="/images/icons/formular/rg_first.png"/>')
+        out.append('</a>')
+
+        out.append(tag("a", name=_('Select previous'),
+                       href="/repeatgroup/select_prev/%s" % child_id))
+        out.append('<img src="/images/icons/formular/rg_prev.png"/>')
+        out.append('</a>')
+
+        out.append(tag("a", name=_('Select next'),
+                       href="/repeatgroup/select_next/%s" % child_id))
+        out.append('<img src="/images/icons/formular/rg_next.png"/>')
+        out.append('</a>')
+
+        out.append(tag("a", name=_('Select last'),
+                       href="/repeatgroup/select_last/%s" % child_id))
+        out.append('<img src="/images/icons/formular/rg_last.png"/>')
+        out.append('</a>')
+
         out.append(' | ?/? | ')
+
         if not self.ro_mode:
-            out.append('<a name="%s" href="/repeatgroup/new/%s">'
-                       '<img src="/images/icons/formular/rg_new.png"/></a>'
-                       % (_('Create new'), child.getIdentifier()))
-            out.append('<a name="%s" href="/repeatgroup/delete/%s">'
-                       '<img src="/images/icons/formular/rg_delete.png"/></a>'
-                       % (_('Delete'), child.getIdentifier()))
+            out.append(tag("a", name=_('Create new'),
+                           href="/repeatgroup/new/%s" % child_id))
+            out.append('<img src="/images/icons/formular/rg_new.png"/>')
+            out.append('</a>')
+
+            out.append(tag("a", name=_('Delete'),
+                           href="/repeatgroup/delete/%s" % child_id))
+            out.append('<img src="/images/icons/formular/rg_delete.png"/>')
+            out.append('</a>')
+
         out.append('</td>')
         out.append('</tr>')
         return out
@@ -403,11 +454,12 @@
         out = []
         if meta.isInvisible():
             return
-        text, depth = meta.getValue(), 1#visibleDepth(node)
+        text = meta.getValue()
+        depth = 1 #visibleDepth(node)
         if text:
             out.append('<p class="text">')
             out.append('<img src="/images/icons/formular/info.png"> ')
-            out.append(text)
+            out.append(escape(text))
             out.append('</p>')
             #text = "<h%s>%s</h%s>\n" % (depth, escape(text), depth)
             self.toTarget(Div("".join(out)), meta.getTarget())
@@ -423,9 +475,8 @@
         out.append(self._renderLabel(node))
         out.append(self._renderAttributes(node))
         out.append('<br>')
-        out.append('<input name="%s" id="%s" value="%s" type="text" size="%s"'
-                   ' maxlength="%s" %s>'
-                   % (id, id, data, size, maxlength, disabled))
+        out.append(tag("input", name=id, id=id, value=data, type="text",
+                       size=size, maxlength=maxlength, disabled=self.ro_mode))
         out.append('<br>')
         out.append(self._renderErrors(node))
         self.toTarget(Item("".join(out)), meta.getTarget())
@@ -441,9 +492,9 @@
         out.append(self._renderLabel(node))
         out.append(self._renderAttributes(node))
         out.append('<br>')
-        out.append('<input name="%s" id="%s" value="%s" type="text" size="%s"'
-                   ' maxlength="%s" %s class="datefield">'
-                   % (id, id, format_date(data), size, maxlength, disabled))
+        out.append(tag("input", name=id, id=id, value=format_date(data),
+                       type="text", size=size, maxlength=maxlength,
+                       disabled=self.ro_mode, class_="datefield"))
         out.append('<br>')
         out.append(self._renderErrors(node))
         self.toTarget(Item("".join(out)), meta.getTarget())
@@ -457,8 +508,8 @@
         out.append(self._renderLabel(node))
         out.append(self._renderAttributes(node))
         out.append('<br>')
-        out.append('<input name="%s" id="%s" value="%s" type="text" %s>'
-                   % (id, id, data, disabled))
+        out.append(tag("input", name=id, id=id, value=data, type="text",
+                       disabled=self.ro_mode))
         out.append('<br>')
         out.append(self._renderErrors(node))
         self.toTarget(Item("".join(out)), meta.getTarget())
@@ -467,7 +518,7 @@
         meta = self._getMeta(node)
         out = []
         id = node.getIdentifier()
-        value = escape(node.getValue() or "")
+        value = node.getValue() or ""
         cols = meta.getCols() or "0"
         rows = meta.getRows() or "0"
         out.append(self._renderLabel(node, not self.ro_mode))
@@ -475,9 +526,12 @@
         out.append('<br>')
 
         if not self.ro_mode:
-            out.append('<textarea id="%s" name="%s" rows="%s" cols="%s">'
-                       '%s</textarea><br>\n' % (id, id, rows, cols, value))
+            out.append(tag("textarea", id=id, name=id, rows=rows, cols=cols))
+            out.append(escape(value))
+            out.append("</textarea>")
+            out.append("<br>\n")
         else:
+            value = escape(value)
             value = value.replace('\r\n', '<br>')
             value = value.replace('\n', '<br>')
             value = value.replace('\r', '<br>')
@@ -494,10 +548,11 @@
             id = child.getIdentifier()
             value = self._getMeta(child).getValue()
             checked = self.stateStack[-1] == value and 'checked="checked"' or ''
-            out.append('<input type="radio" id="%s" name="%s"'
-                       ' value="%s" %s %s %s %s>'
-                       % (id, id, value, disabled, checked,
-                          self.next_tabindex(), SET_MODIFICATION))
+            out.append(tag("input", type="radio", id=id, name=id,
+                           value=value, disabled=self.ro_mode,
+                           checked=self.stateStack[-1] == value,
+                           tabindex=self.next_tabindex(),
+                           **SET_MODIFICATION_ATTRS))
             out.append(self._renderLabel(child))
             out.append(self._renderAttributes(child))
             out.append('<br>')
@@ -515,10 +570,10 @@
         #print "mvalue: %s value: %s" % (mvalue, value)
         checked = mvalue == value and "checked" or ""
         out = []
-        out.append('<input type="checkbox" id="%s" name="%s"'
-                   ' value="%s" %s %s %s %s>'
-                   % (id, id, mvalue, disabled, checked,
-                      self.next_tabindex(), SET_MODIFICATION))
+        out.append(tag("input", type="checkbox", id=id, name=id,
+                       value=mvalue, disabled=self.ro_mode,
+                       checked=(mvalue == value), tabindex=self.next_tabindex(),
+                       **SET_MODIFICATION_ATTRS))
         out.append(self._renderLabel(node))
         out.append(self._renderAttributes(node))
         errors = self._renderErrors(node)
@@ -541,8 +596,9 @@
         out.append(self._renderLabel(node))
         out.append(self._renderAttributes(node))
         out.append('<br>')
-        out.append('<select id="%s" name="%s" size="%s" %s %s %s>'
-                   % (id, id, size, multiple, disabled, SET_MODIFICATION))
+        out.append(tag("select", id=id, name=id, size=size,
+                       multiple=bool(meta.getMultiple()), disabled=self.ro_mode,
+                       **SET_MODIFICATION_ATTRS))
         self.stateStack.append(str(value))
         out.append(self._renderRecursive(meta, False, ChoiceContainer))
         #for child in meta.children:
@@ -566,7 +622,8 @@
         name = meta.getName()
         out = []
         if not self.ro_mode:
-            out.append('<optgroup label="%s">\n' % (description))
+            out.append(tag("optgroup", label=description))
+            out.append("\n")
         out.append(self._renderRecursive(meta, False, ChoiceContainer))
         if not self.ro_mode:
             out.append("</optgroup>\n")
@@ -629,8 +686,8 @@
             else:
                 header = alternative
                 legend.append("<strong>%s</strong>:%s"
-                              % (alternative, description))
-            out.append("<th>%s</th>" % header)
+                              % (escape(alternative), escape(description)))
+            out.append("<th>%s</th>" % escape(header))
         out.append("</tr>")
 
         # write table body
@@ -647,10 +704,11 @@
                 value = col.getValue()
                 checked = value == self.stateStack[-1] and "checked" or ""
                 out.append('<td class="%s">' % (num%2 and "hl" or ""))
-                out.append('<input type="radio" name="%s"'
-                           ' value="%s" %s %s %s %s>'
-                           %(name, value, checked, self.next_tabindex(),
-                             disabled, SET_MODIFICATION) )
+                out.append(tag("input", type="radio", name=name,
+                               value=value, disabled=self.ro_mode,
+                               checked=(value == self.stateStack[-1]),
+                               tabindex=self.next_tabindex(),
+                               **SET_MODIFICATION_ATTRS))
                 out.append('</td>')
             self.stateStack.pop()
             out.append("</tr>")
@@ -704,8 +762,10 @@
                 label = child.getDescription()
                 selected = ((value == self.stateStack[-1])
                             and 'selected="selected"' or '')
-                out.append('<option value="%s" %s>%s</option>'
-                           % (value, selected, label))
+                out.append(tag("option", value=value,
+                               selected=(value == self.stateStack[-1])))
+                out.append(escape(label))
+                out.append("</option>")
         return out
 
     def _renderChild(self, child):
@@ -778,9 +838,10 @@
         out = []
         fields = []
         case_id = rg.getIdentifier().split(':')[-1]
-        digests = rgdigests = {'rg_unterstuetzung':
-                               ['hilfm_art', 'hilfm_inst', 'hilfm_einr',
-                                'hilfm_start', 'hilfm_ende'],
+        digests = rgdigests = {'rg_unterstuetzung': ['hilfm_art', 'hilfm_inst',
+                                                     'hilfm_einr',
+                                                     'hilfm_start',
+                                                     'hilfm_ende'],
                                'rg_kompetenz': ['datum_kf', 'kf_anbiet']}
 
         if digests:
@@ -788,7 +849,7 @@
 
         out.append('<table class="rgdigest">')
         if len(fields) < 1:
-            out.append('<tr><td>%s</td></tr>' % rg.getIdentifier())
+            out.append('<tr><td>%s</td></tr>' % escape(rg.getIdentifier()))
         else:
             for num, field in enumerate(fields):
                 item = self.it.getItem('%s:%s:%s'
@@ -796,19 +857,20 @@
                                           case_id))
                 out.append('<tr>')
                 out.append('<td class="label">')
-                out.append('<a href="/navigation/select_branch/%s">'
-                           % rg.getChildren()[0].getIdentifier())
-                out.append(self._getMeta(item).getDescription())
+                out.append(tag("a",
+                               href=("/navigation/select_branch/%s"
+                                     % rg.getChildren()[0].getIdentifier())))
+                out.append(escape(self._getMeta(item).getDescription()))
                 out.append('</a>')
                 out.append('</td>')
                 out.append('<td>')
-                out.append('<a href="/navigation/select_branch/%s">'
-                           % rg.getChildren()[0].getIdentifier())
+                out.append(tag("a",
+                               href=("/navigation/select_branch/%s"
+                                     % rg.getChildren()[0].getIdentifier())))
                 value = item.getValue()
                 if isinstance(self._getMeta(item), data.DateLeaf):
-                    if value:
-                        value = format_date(value)
-                out.append('%s' % NA(value))
+                    value = format_date(value)
+                out.append('%s' % escape(NA(value)))
                 out.append('</a>')
                 out.append('</td>')
                 out.append('</tr>')
@@ -820,33 +882,40 @@
         out.append('<div class="widget">')
         out.append('<table class="list">')
         out.append('<tr><th>%s</th><th class="actions">%s</th>'
-                   % (_('Description'), _('Actions')))
+                   % (escape(_('Description')),
+                      escape(_('Actions'))))
         for num, rg in enumerate(self.page.getChildren()):
             out.append('<tr>')
             out.append('<td>')
             out.append(self.render_digest(rg))
             out.append('</td>')
             out.append('<td class="actions">')
-            out.append('<a href="/navigation/select_branch/%s">'
-                       '<img src="/images/icons/view_red.gif" border="0"'
-                       ' alt="%s" title="%s"></a>'
-                       % (rg.getChildren()[0].getIdentifier(), _('view'),
-                          _('view')))
+            out.append(tag("a", href=("/navigation/select_branch/%s"
+                                      % rg.getChildren()[0].getIdentifier())))
+            out.append(tag("img", src="/images/icons/view_red.gif", border="0",
+                           alt=_('view'), title=_('view')))
+            out.append("</a>")
             if not self.ro_mode:
-                out.append('<a href="/repeatgroup/delete/%s">'
-                           '<img src="/images/icons/delete_red.gif" border="0"'
-                           ' alt="%s" title="%s"></a>'
-                           % (rg.getIdentifier(), _('delete'), _('delete')))
+                out.append(tag("a", href=("/repeatgroup/delete/%s"
+                                          % rg.getIdentifier())))
+                out.append(tag("img", src="/images/icons/delete_red.gif",
+                               border="0", alt=_('delete'), title=_('delete')))
+                out.append("</a>")
             out.append('</td>')
             out.append('</tr>')
         out.append('</table>')
         out.append('</div>')
         out.append('<div>%s %s</div>'
-                   % (len(self.page.getChildren()), _('Items found')))
+                   % (len(self.page.getChildren()), escape(_('Items found'))))
         if not self.ro_mode:
-            out.append('<div><br><a href="/repeatgroup/new/%s" class="button">'
-                       '%s</a></div>'
-                       % (self.page.getIdentifier(), _('Create new item')))
+            out.append('<div>')
+            out.append('<br>')
+            out.append(tag("a", class_="button",
+                           href=("/repeatgroup/new/%s"
+                                 % self.page.getIdentifier())))
+            out.append(escape(_('Create new item')))
+            out.append("</a>")
+            out.append("</div>")
         return "\n".join(out)
 
 
@@ -870,19 +939,23 @@
         if self.error_items:
             out.append('<div class="widget dialog">')
             out.append('<h1><img src="/images/alert.png">%s</h1>'
-                       % _('Formular errors'))
+                       % escape(_('Formular errors')))
             out.append('<ol>')
 
             for k, v in self.error_items.iteritems():
                 element = tree.getFormEd().findByName(k.split(':')[0])
                 description = element.getDescription()
-                out.append('<li><a href="/formularpage/undo/%s">' % k)
-                out.append('<img src="/images/icons/formular/undo.png"'
-                           ' border="0" alt="undo" title="%s"/>'
-                           % _('Restore last valid value'))
-                out.append('</a>'
-                           '<a class="error" href="#f_%s">%s: %s</a></li>'
-                           % (k, description, v))
+                out.append('<li>')
+                out.append(tag("a", href="/formularpage/undo/%s" % k))
+                out.append(tag("img", src="/images/icons/formular/undo.png",
+                               border="0", alt="undo",
+                               title=_('Restore last valid value'),
+                               _close=True))
+                out.append('</a>')
+                out.append(tag("a", class_="error", href="#f_%s" % k))
+                out.append("%s: %s" % (escape(description), escape(v)))
+                out.append("</a>")
+                out.append("</li>")
 
             out.append('</ol>')
             out.append('</div>')
@@ -890,19 +963,24 @@
         if self.warnings:
             out.append('<div class="widget dialog">')
             out.append('<h1><img src="/images/info.png">%s</h1>'
-                       % _('Formular warnings'))
+                       % escape(_('Formular warnings')))
             out.append('<ol>')
 
             for k, v in self.warnings.iteritems():
                 element = tree.getFormEd().findByName(k.split(':')[0])
                 description = element.getDescription()
-                out.append('<li><a href="/formularpage/undo/%s">' % k)
-                out.append('<img src="/images/icons/formular/undo.png"'
-                           ' border="0" alt="undo" title="%s"/>'
-                           % _('Restore last valid value'))
-                out.append('</a>'
-                           '<a class="error" href="#f_%s">%s: %s</a></li>'
-                           % (k, description, v))
+                out.append('<li>')
+                out.append(tag("a", href="/formularpage/undo/%s" % k))
+                out.append(tag("img", src="/images/icons/formular/undo.png",
+                               border="0", alt="undo",
+                               title=_('Restore last valid value'),
+                               _close=True))
+                out.append('</a>')
+                out.append(tag("a", class_="error", href="#f_%s" % k))
+                out.append("%s: %s" % (escape(description), escape(v)))
+                out.append("</a>")
+                out.append("</li>")
+
             out.append('</ol>')
             out.append('</div>')
 



More information about the Mpuls-commits mailing list