Log in and log out require escape and mark_safe

rest_framework/templatetags/rest_framework.py

@@ -41,8 +41,9 @@ def optional_login(request):
     except NoReverseMatch:
         return ''
 
-    snippet = "<li><a href='{href}?next={next}'>Log in</a></li>".format(href=login_url, next=escape(request.path))
-    return snippet
+    snippet = "<li><a href='{href}?next={next}'>Log in</a></li>"
+    snippet = snippet.format(href=login_url, next=escape(request.path))
+    return mark_safe(snippet)
 
 
 @register.simple_tag
@@ -64,8 +65,8 @@ def optional_logout(request, user):
             <li><a href='{href}?next={next}'>Log out</a></li>
         </ul>
     </li>"""
-
-    return snippet.format(user=user, href=logout_url, next=escape(request.path))
+    snippet = snippet.format(user=escape(user), href=logout_url, next=escape(request.path))
+    return mark_safe(snippet)
 
 
 @register.simple_tag