Refactor HTML formatting to use mark_safe for safe rendering in various tables and models

generic/tables.py

@@ -3,6 +3,7 @@ import django_tables2 as tables
 from django_tables2.utils import A
 
 from django.utils.html import format_html
+from django.utils.safestring import mark_safe
 
 from easy_thumbnails.files import get_thumbnailer
 
@@ -85,7 +86,7 @@ class SelectionTable(tables.Table):
 
         # Also include a small data attribute so client scripts can locate the
         # controls by selection name if they prefer.
-        return format_html(html)
+        return mark_safe(html)
 
 class SingleImageColumn(tables.Column):
     def render(self, value):
@@ -100,7 +101,7 @@ class BlockImageColumn(tables.Column):
         blocks = []
         for obj in value.all():
             blocks.append(obj.get_block())
-        return format_html(
+        return mark_safe(
             """<span class='multi-image-block'>
             {}
             </span>""".format("".join(blocks))
@@ -112,9 +113,7 @@ class SeriesImageColumn(tables.Column):
         images = value.all()
 
         if not images:
-            return format_html(
-                '<span>None<span><br/>',
-            )
+            return mark_safe('<span>None</span><br/>')
 
         obj = findMiddle(images)
 
@@ -141,7 +140,7 @@ class FirstImageColumn(tables.Column):
         obj = value.all()
 
         if not obj:
-            return format_html('<span>No image<span>')
+            return mark_safe('<span>No image</span>')
 
         image_object = obj[0].image
         try:
@@ -196,7 +195,7 @@ class CidUserTable(SelectionTable):
         if record.supervisor is not None:
             return format_html("""{}\n[{}]""", record.email, record.supervisor.email)
         else:
-            return format_html(record.email)
+            return record.email
 
 
 class CidUserExamTable(SelectionTable):
@@ -249,7 +248,7 @@ class CidUserExamTable(SelectionTable):
         if record.supervisor is not None:
             return format_html("""{}\n[{}]""", record.email, record.supervisor.email)
         else:
-            return format_html(record.email)
+            return record.email
 
 
 #    def render_cid(self, value, record):

generic/views.py

@@ -16,6 +16,7 @@ from django.urls import reverse_lazy
 from django.urls.base import reverse
 from django.utils import timezone
 from django.utils.html import format_html
+from django.utils.safestring import mark_safe
 from django.views.decorators.csrf import csrf_exempt
 from django.core.exceptions import PermissionDenied, FieldError
 
@@ -850,7 +851,7 @@ def generic_exam_set_open_access(request):
     # For now require the user to have edit access (ExamViews.check_user_edit_access equivalent)
     # We'll do a lightweight check: if user is superuser OR user in exam.get_author_objects()
     if not (request.user.is_superuser or request.user in exam.get_author_objects()):
-        return HttpResponse(format_html('<div class="alert alert-danger">Permission denied</div>'))
+        return HttpResponse(mark_safe('<div class="alert alert-danger">Permission denied</div>'))
 
     set_val = True if request.POST.get("set_open_access") == "true" else False
 
@@ -1147,7 +1148,7 @@ class ExamViews(View, LoginRequiredMixin):
         if request.method == "POST":
             if not self.check_user_edit_access(request.user, exam_id=pk):
                 return HttpResponse(
-                    format_html(
+                    mark_safe(
                         '<div class="alert alert-danger" role="alert">Error toggling results published.</div>'
                     )
                 )
@@ -1163,7 +1164,7 @@ class ExamViews(View, LoginRequiredMixin):
                 })
         else:
             HttpResponse(
-                format_html(
+                mark_safe(
                     '<div class="alert alert-danger" role="alert">Error toggling results published.</div>'
                 ) 
             )
@@ -1173,7 +1174,7 @@ class ExamViews(View, LoginRequiredMixin):
         if request.method == "POST":
             if not self.check_user_edit_access(request.user, exam_id=pk):
                 return HttpResponse(
-                    format_html(
+                    mark_safe(
                         '<div class="alert alert-danger" role="alert">Error toggling exam active.</div>'
                     )
                 )
@@ -1189,7 +1190,7 @@ class ExamViews(View, LoginRequiredMixin):
                 })
         else:
             HttpResponse(
-                format_html(
+                mark_safe(
                     '<div class="alert alert-danger" role="alert">Error toggling exam active.</div>'
                 ) 
             )
@@ -4722,7 +4723,7 @@ def user_group_add_by_email_user(request, group_id):
             res += f"<br/><div class='alert alert-warning'>Invalid emails [{','.join(invalid_emails)}]</div>"
 
 
-        return HttpResponse(format_html(res), content_type="text/html")
+        return HttpResponse(res, content_type="text/html")