{% comment %} Renders each selected item in the TomSelect input. {% endcomment %} {% load i18n %} item: function(data, escape) { {% include "django_tomselect/helpers/decode_if_needed.html" %} {% if 'data_template_item' in widget.attrs.keys and widget.attrs.data_template_item %} // Use safe Function constructor with escape function provided var template = {{ widget.attrs.data_template_item|safe }}; // Always use escape function return new Function('data', 'escape', 'return `' + template + '`')(data, escape); {% else %} let item = ''; const safeValue = escape(decodeIfNeeded(data.{{ widget.label_field }})); item += `
${safeValue}`; {% if "show_detail" in widget and widget.show_detail %} if (data.detail_url) { item += ` `; } {% endif %} {% if "show_delete" in widget and widget.show_delete %} if (data.delete_url) { item += ` `; } {% endif %} {% if "show_update" in widget and widget.show_update %} if (data.update_url) { item += ` `; } {% endif %} item += '
'; return item; {% endif %} },