Merge pull request #3556 from rense/master

format_html was missing in optional_logout template-tag
encode · Oct 28, 2015 · a67d231 · a67d231
2 parents b8c9c80 + 0d568ed
commit a67d231
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rest_framework/templatetags/rest_framework.py b/rest_framework/templatetags/rest_framework.py
@@ -61,7 +61,8 @@ def optional_logout(request, user):
     try:
         logout_url = reverse('rest_framework:logout')
     except NoReverseMatch:
-        return '<li class="navbar-text">{user}</li>'.format(user=user)
+        snippet = format_html('<li class="navbar-text">{user}</li>', user=escape(user))
+        return mark_safe(snippet)
 
     snippet = """<li class="dropdown">
         <a href="#" class="dropdown-toggle" data-toggle="dropdown">