Mark message as HTML safe in templates

[atodorov]

will allow using messages which contain HTML tags like links.

Fixes kiwitcms/Kiwi#964

[sehmaschine]

Thanks for the PR, but I'm not sure about this since Django doesn't allow for safe messages as well. There might be a (good) reason it is not allowed?

[atodorov]

Django doesn't allow for safe messages as well

I'm not sure what do you mean here? I do have my application stuffing a bunch of HTML in the message and on the admin pages it sadly doesn't render nicely.

There might be a (good) reason it is not allowed?

Sure, if you aren't careful that's XSS waiting to happen at the very least.

I don't see an obvious way to mark the message as safe when it comes from the backend though.

[sehmaschine]

I'm referring to this:
https://github.com/django/django/blob/master/django/contrib/admin/templates/admin/base.html#L70

[atodorov]

I've found django.utils.safestring.mark_safe() which allows me to handle this on the app side.