# HG changeset patch
# User RhodeCode Admin <admin@rhodecode.com>
# Date 2023-03-20 20:18:00
# Node ID 43b9c1661a6b5f0aafef932d589b2bd7a515c63a
# Parent  f8bf1fa643a41becc58e86f125ce774246bb80ad

templates: use safe md5 for str template rendering

diff --git a/rhodecode/templates/base/base.mako b/rhodecode/templates/base/base.mako
--- a/rhodecode/templates/base/base.mako
+++ b/rhodecode/templates/base/base.mako
@@ -189,7 +189,7 @@
               ${val}
           %endif
           %if show_items:
-              <div class="collapsable-content" data-toggle="item-${h.md5_safe(val)[:6]}-details" style="display: none">
+              <div class="collapsable-content" data-toggle="item-${h.md5_safe(h.safe_str(val))[:6]}-details" style="display: none">
               % for item in show_items:
                   <dt></dt>
                   <dd>${item}</dd>
@@ -199,7 +199,7 @@
         </td>
         <td style="vertical-align: top">
           %if show_items:
-              <span class="btn-collapse" data-toggle="item-${h.md5_safe(val)[:6]}-details">${_('Show More')} </span>
+              <span class="btn-collapse" data-toggle="item-${h.md5_safe(h.safe_str(val))[:6]}-details">${_('Show More')} </span>
           %endif
         </td>
     </tr>
diff --git a/rhodecode/templates/codeblocks/diffs.mako b/rhodecode/templates/codeblocks/diffs.mako
--- a/rhodecode/templates/codeblocks/diffs.mako
+++ b/rhodecode/templates/codeblocks/diffs.mako
@@ -59,7 +59,7 @@ return '%s_%s_%i' % (h.md5_safe(commit+f
 )">
 
 <%
-    diffset_container_id = h.md5(diffset.target_ref)
+    diffset_container_id = h.md5_safe(diffset.target_ref)
     collapse_all = len(diffset.files) > collapse_when_files_over
     active_pattern_entries = h.get_active_pattern_entries(getattr(c, 'repo_name', None))
     from rhodecode.lib.diffs import NEW_FILENODE, DEL_FILENODE, \
@@ -909,7 +909,7 @@ def get_comments_for(diff_type, comments
 </%def>
 
 <%def name="render_diffset_menu(diffset, range_diff_on=None, commit=None, pull_request_menu=None)">
-    <% diffset_container_id = h.md5(diffset.target_ref) %>
+    <% diffset_container_id = h.md5_safe(diffset.target_ref) %>
 
     <div id="diff-file-sticky" class="diffset-menu clearinner">
         ## auto adjustable