django - ckeditor bug renders text/string in raw html format

Question

am using django ckeditor. Any text/content entered into its editor renders raw html output on the webpage.

for ex: this is rendered output of ckeditor field (RichTextField) on a webpage;

<p><span style="color:rgb(0, 0, 0)">this is a test file &rsquo;s forces durin</span><span style="color:rgb(0, 0, 0)">galla&rsquo;s good test is one that fails Thereafter, never to fail in real environment.&nbsp;</span></p>

I have been looking for a solution for a long time now but unable to find one :( There are some questions which are similar but none of those have been able to help. It will be helpful if any changes suggested are provided with the exact location where it needs to be changed. Needless to say I am a newbie.

Thanks

Answer 1

You need to mark the relevant variable that contains the html snippet in your template as safe

Obviously you should be sure, that the text comes from trusted users and is safe, because with the safe filter you are disabling a security feature (autoescaping) that Django applies per default.

If your ckeditor is part of a comment form and your mark the entered text as safe, anybody with access to the form could inject Javascipt and other (potentially nasty) stuff in your page.

The whole story is explained pretty well in the official docs: https://docs.djangoproject.com/en/dev/topics/templates/#automatic-html-escaping