From 5f8334ebb78f1f7d704385a75652622dd5675557 Mon Sep 17 00:00:00 2001
From: Tim Graham <timograham@gmail.com>
Date: Thu, 21 Jul 2016 04:33:15 +0200
Subject: CVE-2016-6186: Fixed XSS in admin's add/change related popup.

Origin: upstream, https://github.com/django/django/commit/8462b3fa9c0a59221a8b5583025c3a9fff637d85
Forwarded: not-needed
Reviewed-by: Luke Faraone <lfaraone@debian.org>
Last-Update: 2016-07-16
Applied-Upstream: 1.8.14
---
 django/views/debug.py       | 4 ++--
 tests/admin_views/admin.py  | 3 ++-
 tests/admin_views/models.py | 4 ++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/django/views/debug.py b/django/views/debug.py
index 13992e9..7d8ea05 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -637,13 +637,13 @@ TECHNICAL_500_TEMPLATE = """
       var s = link.getElementsByTagName('span')[0];
       var uarr = String.fromCharCode(0x25b6);
       var darr = String.fromCharCode(0x25bc);
-      s.innerHTML = s.innerHTML == uarr ? darr : uarr;
+      s.textContent = s.textContent == uarr ? darr : uarr;
       return false;
     }
     function switchPastebinFriendly(link) {
       s1 = "Switch to copy-and-paste view";
       s2 = "Switch back to interactive view";
-      link.innerHTML = link.innerHTML == s1 ? s2: s1;
+      link.textContent = link.textContent.trim() == s1 ? s2: s1;
       toggle('browserTraceback', 'pastebinTraceback');
       return false;
     }
diff --git a/tests/admin_views/admin.py b/tests/admin_views/admin.py
index 15c1384..36187af 100644
--- a/tests/admin_views/admin.py
+++ b/tests/admin_views/admin.py
@@ -83,7 +83,8 @@ class ChapterXtra1Admin(admin.ModelAdmin):
 
 class ArticleAdmin(admin.ModelAdmin):
     list_display = ('content', 'date', callable_year, 'model_year',
-                    'modeladmin_year', 'model_year_reversed')
+                    'modeladmin_year', 'model_year_reversed', 'section')
+    list_editable = ('section',)
     list_filter = ('date', 'section')
     view_on_site = False
     fieldsets = (
diff --git a/tests/admin_views/models.py b/tests/admin_views/models.py
index f41b4de..79dd56c 100644
--- a/tests/admin_views/models.py
+++ b/tests/admin_views/models.py
@@ -15,6 +15,7 @@ from django.db import models
 from django.utils.encoding import python_2_unicode_compatible
 
 
+@python_2_unicode_compatible
 class Section(models.Model):
     """
     A simple section that links to articles, to test linking to related items
@@ -22,6 +23,9 @@ class Section(models.Model):
     """
     name = models.CharField(max_length=100)
 
+    def __str__(self):
+        return self.name
+
     @property
     def name_property(self):
         """