From 539c7f96a8dd3641a412b5fc66a6c7fe26089c20 Mon Sep 17 00:00:00 2001
From: Shengjing Zhu <zsj950618@gmail.com>
Date: May 18 2017 19:19:36 +0000
Subject: fix double escape in html template


content filtered by noJS is safe, jinja should not escape it again,
fixes https://pagure.io/pagure/issue/2284

same old problem here:
https://pagure.io/pagure/issue/336
which is fixed by:
https://pagure.io/pagure/c/5e64f815

Signed-off-by: Shengjing Zhu <zsj950618@gmail.com>

---

diff --git a/pagure/templates/blame.html b/pagure/templates/blame.html
index 030d072..dd2afe1 100644
--- a/pagure/templates/blame.html
+++ b/pagure/templates/blame.html
@@ -165,11 +165,7 @@ No content found in this repository
      <strong>README{{readme_ext}}</strong>
    </div>
    <div class="card-block">
-   {% if safe %}
-     {{ readme | noJS |safe }}
-   {% else %}
-     {{ readme | noJS }}
-   {% endif %}
+   {{ readme | noJS | safe }}
  </div>
  </div>
  {% endif %}
diff --git a/pagure/templates/file.html b/pagure/templates/file.html
index c2c6595..75a9f7a 100644
--- a/pagure/templates/file.html
+++ b/pagure/templates/file.html
@@ -165,7 +165,7 @@
     {% elif output_type == 'markup' %}
         <div class="m-a-2">
         {% autoescape false %}
-        {{ content | noJS }}
+        {{ content | noJS | safe }}
         {% endautoescape %}
       </div>
     {% elif output_type == 'image' %}
@@ -235,11 +235,7 @@ No content found in this repository
      <strong>README{{readme_ext}}</strong>
    </div>
    <div class="card-block">
-   {% if safe %}
-     {{ readme | noJS |safe }}
-   {% else %}
-     {{ readme | noJS }}
-   {% endif %}
+   {{ readme | noJS | safe }}
  </div>
  </div>
  {% endif %}
diff --git a/pagure/templates/pull_request.html b/pagure/templates/pull_request.html
index 3f80852..3b21acb 100644
--- a/pagure/templates/pull_request.html
+++ b/pagure/templates/pull_request.html
@@ -3,7 +3,7 @@
 
 {% block title %}
   {%- if pull_request -%}
-    PR#{{ requestid }}: {{ pull_request.title | noJS(ignore="img")}}
+    PR#{{ requestid }}: {{ pull_request.title | noJS(ignore="img") | safe }}
   {%- elif form and (g.repo_committer or remote_git) -%}
     Create new Pull Request for {{ branch_to }}
   {%- elif origin == 'compare_commits' -%}
diff --git a/pagure/templates/repo_info.html b/pagure/templates/repo_info.html
index 36af040..486994e 100644
--- a/pagure/templates/repo_info.html
+++ b/pagure/templates/repo_info.html
@@ -35,11 +35,7 @@ git push -u origin master</pre>
         <div class="col-md-8">
           {% if readme %}
             <section class="readme">
-              {% if safe %}
-                {{ readme | noJS |safe }}
-              {% else %}
-                {{ readme | noJS }}
-              {% endif %}
+              {{ readme | noJS | safe }}
             </section>
             {% else %}
             <section class="no-readme">
diff --git a/tests/test_pagure_flask_ui_app.py b/tests/test_pagure_flask_ui_app.py
index 93a9f5f..d7863e7 100644
--- a/tests/test_pagure_flask_ui_app.py
+++ b/tests/test_pagure_flask_ui_app.py
@@ -415,7 +415,7 @@ class PagureFlaskApptests(tests.Modeltests):
                 output.data if six.PY2 else output.data.decode('utf-8'))
             self.assertIn(
                 '''<section class="readme">
-                <h1>project-1</h1>
+              <h1>project-1</h1>
 <p>Prõjéctö #1</p>
             </section>''', output.data if six.PY2 else output.data.decode('utf-8'))
 
@@ -432,7 +432,7 @@ class PagureFlaskApptests(tests.Modeltests):
                 output.data if six.PY2 else output.data.decode('utf-8'))
             self.assertIn(
                 '''<section class="readme">
-                <h1>project-2</h1>
+              <h1>project-2</h1>
 <p>Мой первый суперский репозиторий</p>
             </section>''', output.data if six.PY2 else output.data.decode('utf-8'))