From 846a12e736662fb468dbac60aaa4f89a36df9277 Mon Sep 17 00:00:00 2001
From: Jasper Hafkenscheid <jasper.hafkenscheid@voys.nl>
Date: Mon, 27 Jul 2026 06:50:47 +0200
Subject: [PATCH] fix: pass format_html() placeholder args instead of pre-built
 strings

Django's format_html() now raises TypeError when called with no args/kwargs,
since a caller building the whole string themselves defeats its escaping
purpose. Affects every templatetag that used this pattern, breaking
report/repo/host list pages.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 hosts/templatetags/report_alert.py |  7 +++----
 repos/templatetags/repo_buttons.py | 32 +++++++++++-------------------
 util/templatetags/common.py        | 12 ++++-------
 3 files changed, 19 insertions(+), 32 deletions(-)

diff --git a/hosts/templatetags/report_alert.py b/hosts/templatetags/report_alert.py
index a28c50588..a763647cd 100644
--- a/hosts/templatetags/report_alert.py
+++ b/hosts/templatetags/report_alert.py
@@ -28,13 +28,12 @@
 
 @register.simple_tag
 def report_alert(lastreport):
-    html = ''
-    alert_icon = static('img/icon-alert.gif')
     days = get_setting_of_type(
         setting_name='DAYS_WITHOUT_REPORT',
         setting_type=int,
         default=14,
     )
     if lastreport < (timezone.now() - timedelta(days=days)):
-        html = f'<img src="{alert_icon}" alt="Outdated Report" />'
-    return format_html(html)
+        alert_icon = static('img/icon-alert.gif')
+        return format_html('<img src="{}" alt="Outdated Report" />', alert_icon)
+    return ''
diff --git a/repos/templatetags/repo_buttons.py b/repos/templatetags/repo_buttons.py
index 3689c8b7c..2ba3950ee 100644
--- a/repos/templatetags/repo_buttons.py
+++ b/repos/templatetags/repo_buttons.py
@@ -26,29 +26,21 @@
 def yes_no_button_repo_en(repo):
 
     repo_url = repo.get_absolute_url()
-    yes_icon = static('img/icon-yes.gif')
-    no_icon = static('img/icon-no.gif')
-    html = '<button onclick="repo_toggle_enabled'
-    html += f'(\'{repo_url}\', this, event)">'
-    if repo.enabled:
-        html += f'<img src="{yes_icon}" alt="Enabled" />'
-    else:
-        html += f'<img src="{no_icon}" alt="Disabled" />'
-    html += '</button>'
-    return format_html(html)
+    icon = static('img/icon-yes.gif') if repo.enabled else static('img/icon-no.gif')
+    alt = 'Enabled' if repo.enabled else 'Disabled'
+    return format_html(
+        '<button onclick="repo_toggle_enabled(\'{}\', this, event)"><img src="{}" alt="{}" /></button>',
+        repo_url, icon, alt,
+    )
 
 
 @register.simple_tag
 def yes_no_button_repo_sec(repo):
 
     repo_url = repo.get_absolute_url()
-    yes_icon = static('img/icon-yes.gif')
-    no_icon = static('img/icon-no.gif')
-    html = '<button onclick="repo_toggle_security'
-    html += f'(\'{repo_url}\', this, event)">'
-    if repo.security:
-        html += f'<img src="{yes_icon}" alt="Security" />'
-    else:
-        html += f'<img src="{no_icon}" alt="Non-Security" />'
-    html += '</button>'
-    return format_html(html)
+    icon = static('img/icon-yes.gif') if repo.security else static('img/icon-no.gif')
+    alt = 'Security' if repo.security else 'Non-Security'
+    return format_html(
+        '<button onclick="repo_toggle_security(\'{}\', this, event)"><img src="{}" alt="{}" /></button>',
+        repo_url, icon, alt,
+    )
diff --git a/util/templatetags/common.py b/util/templatetags/common.py
index 6737c4386..ffb795567 100644
--- a/util/templatetags/common.py
+++ b/util/templatetags/common.py
@@ -45,10 +45,8 @@ def yes_no_img(boolean, alt_yes='Active', alt_no='Not Active'):
     yes_icon = static('img/icon-yes.gif')
     no_icon = static('img/icon-no.gif')
     if boolean:
-        html = f'<img src="{yes_icon}" alt="{alt_yes}" />'
-    else:
-        html = f'<img src="{no_icon}" alt="{alt_no}" />'
-    return format_html(html)
+        return format_html('<img src="{}" alt="{}" />', yes_icon, alt_yes)
+    return format_html('<img src="{}" alt="{}" />', no_icon, alt_no)
 
 
 @register.simple_tag
@@ -56,10 +54,8 @@ def no_yes_img(boolean, alt_yes='Not Required', alt_no='Required'):
     yes_icon = static('img/icon-yes.gif')
     no_icon = static('img/icon-no.gif')
     if not boolean:
-        html = f'<img src="{yes_icon}" alt="{alt_yes}" />'
-    else:
-        html = f'<img src="{no_icon}" alt="{alt_no}" />'
-    return format_html(html)
+        return format_html('<img src="{}" alt="{}" />', yes_icon, alt_yes)
+    return format_html('<img src="{}" alt="{}" />', no_icon, alt_no)
 
 
 @register.simple_tag