Don't mark messages safe by default

apps/amo/messages.py

@@ -11,27 +11,34 @@ except it will take a 3rd argument as message content (the second is the message
 title).
 """
 
-def _make_message(title=None, message=None):
-    c = {'title': title, 'message': message}
+def _make_message(title=None, message=None, title_safe=False,
+                                            message_safe=False):
+    c = {'title': title, 'message': message,
+         'title_safe': title_safe, 'message_safe': message_safe}
     t = env.get_template('message_content.html').render(**c)
     return jinja2.Markup(t)
 
-def debug(request, title, msg=None, extra_tags='', fail_silently=False):
-    django_messages.debug(request, _make_message(title, msg),
-                          extra_tags, fail_silently)
+def debug(request, title, message=None, extra_tags='', fail_silently=False,
+          title_safe=False, message_safe=False):
+    msg = _make_message(title, message, title_safe, message_safe)
+    django_messages.debug(request, msg, extra_tags, fail_silently)
 
-def info(request, title, msg=None, extra_tags='', fail_silently=False):
-    django_messages.info(request, _make_message(title, msg),
-                          extra_tags, fail_silently)
+def info(request, title, message=None, extra_tags='', fail_silently=False,
+         title_safe=False, message_safe=False):
+    msg = _make_message(title, message, title_safe, message_safe)
+    django_messages.info(request, msg, extra_tags, fail_silently)
 
-def success(request, title, msg=None, extra_tags='', fail_silently=False):
-    django_messages.success(request, _make_message(title, msg),
-                          extra_tags, fail_silently)
+def success(request, title, message=None, extra_tags='', fail_silently=False,
+            title_safe=False, message_safe=False):
+    msg = _make_message(title, message, title_safe, message_safe)
+    django_messages.success(request, msg, extra_tags, fail_silently)
 
-def warning(request, title, msg=None, extra_tags='', fail_silently=False):
-    django_messages.warning(request, _make_message(title, msg),
-                          extra_tags, fail_silently)
+def warning(request, title, message=None, extra_tags='', fail_silently=False,
+            title_safe=False, message_safe=False):
+    msg = _make_message(title, message, title_safe, message_safe)
+    django_messages.warning(request, msg, extra_tags, fail_silently)
 
-def error(request, title, msg=None, extra_tags='', fail_silently=False):
-    django_messages.error(request, _make_message(title, msg),
-                          extra_tags, fail_silently)
+def error(request, title, message=None, extra_tags='', fail_silently=False,
+          title_safe=False, message_safe=False):
+    msg = _make_message(title, message, title_safe, message_safe)
+    django_messages.error(request, msg, extra_tags, fail_silently)

apps/bandwagon/views.py

@@ -256,7 +256,8 @@ def add(request):
             msg = _("""Your new collection is shown below. You can <a
                        href="%(url)s">edit additional settings</a> if you'd
                        like.""") % {'url': collection.edit_url()}
-            messages.success(request, title, msg, extra_tags='collection')
+            messages.success(request, title, msg, extra_tags='collection',
+                             message_safe=True)
             log.info('Created collection %s' % collection.id)
             return http.HttpResponseRedirect(collection.get_url_path())
         else:
@@ -367,7 +368,8 @@ def edit(request, collection, username, slug):
             title = _("Collection updated!")
             msg = _(("""<a href="%(url)s">View your collection</a> to see the
                         changes.""")) % {'url': collection.get_url_path()}
-            messages.success(request, title, msg, extra_tags='collection')
+            messages.success(request, title, msg, extra_tags='collection',
+                             message_safe=True)
             log.info(u'%s edited collection %s' %
                      (request.amo_user, collection.id))
             return http.HttpResponseRedirect(collection.edit_url())

templates/message_content.html

@@ -1,6 +1,18 @@
-    {% if title %}
-      <h2>{{ title|safe }}</h2>
-    {% endif %}
-    {% if message %}
-      <p>{{ message|safe }}</p>
-    {% endif %}
+  {% if title %}
+    <h2>
+      {% if title_safe %}
+        {{ title|safe }}
+      {% else %}
+        {{ title }}
+      {% endif %}
+    </h2>
+  {% endif %}
+  {% if message %}
+    <p>
+      {% if message_safe %}
+        {{ message|safe }}
+      {% else %}
+        {{ message }}
+      {% endif %}
+    </p>
+  {% endif %}