automatically escape Translations in __unicode__ (bug 619743)

apps/translations/models.py

@@ -1,6 +1,7 @@
 from django.db import models, connection
 from django.utils import encoding
 
+import jinja2
 from bleach import Bleach
 
 import amo.models
@@ -35,7 +36,12 @@ class Translation(amo.models.ModelBase):
         unique_together = ('id', 'locale')
 
     def __unicode__(self):
-        return self.localized_string and unicode(self.localized_string) or ''
+        if self.localized_string:
+            return jinja2.escape(unicode(self.localized_string))
+        return ''
+
+    def __html__(self):
+        return unicode(self)
 
     def __nonzero__(self):
         # __nonzero__ is called to evaluate an object in a boolean context.  We

apps/translations/tests/test_models.py

@@ -349,6 +349,9 @@ def test_translation_unicode():
 
     eq_(unicode(t('hello')), 'hello')
     eq_(unicode(t(None)), '')
+    eq_(unicode(t('<evil>')), '&lt;evil&gt;')
+    assert isinstance(unicode(t('hello')), jinja2.Markup)
+    eq_(t('<evil>').__html__(), '&lt;evil&gt;')
 
 
 def test_widget_value_from_datadict():