Merge pull request #271 from datamade/hotfix/jfc/2.5-escape-selected-…

…facets Properly escape selected facets in search.html
datamade · Aug 20, 2020 · c584eeb · c584eeb
2 parents 57ac46e + cc0d28c
commit c584eeb
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/councilmatic_core/templates/search/search.html b/councilmatic_core/templates/search/search.html
@@ -275,6 +275,7 @@ <h3 class="modal-links">
 {% endblock %}
 
 {% block extra_js %}
+    {{ selected_facets|json_script:"selected-facets" }}
     <script>
     $(document).ready(function() {
         $("#searchSubscribe").click(function() {
@@ -283,15 +284,15 @@ <h3 class="modal-links">
 
             if ('{{ request.user }}' != 'AnonymousUser') {
                 posturl2 = "/search_check_subscription/"
-                facets2 = JSON.stringify({{selected_facets|safe}});
+                facets2 = $('#selected-facets').text();
                 stuff2 = $.post(posturl2, { query: "{{request.GET.q}}", selected_facets: facets2 },
                     function(data, status) {
                     console.log("returned from post with data: ", data, "status:", status);
                 }).error(function() {
                 console.log("Could not check subscription for interest {{request.GET.q}} with {{facets2}}" );
                 }),
                 posturl = "/search_subscribe/" //+ "{{request.GET.q}}"
-                facets =  JSON.stringify({{selected_facets|safe}});
+                facets =  $('#selected-facets').text();
                 $.post(posturl, { query: "{{request.GET.q}}", selected_facets: facets }).then(function() {
                     $(bullHorn).hide();
                     $(bullHornNew).show();

diff --git a/setup.py b/setup.py
@@ -22,7 +22,7 @@
                       'opencivicdata>=3.1.0',
                       'pytz>=2015.4',
                       'django-haystack>=2.8.0,<2.9',
-                      'Django>=2.0,<2.2',
+                      'Django>=2.1,<2.2',
                       'django-proxy-overrides>=0.2.1',
                       'python-dateutil>=2.7,<2.8',
                       'pysolr>=3.8,<3.9',