From 6302e6051e6069f20bc4a8996f239fa08e893b43 Mon Sep 17 00:00:00 2001
From: Fabian Braun <fsbraun@gmx.de>
Date: Thu, 22 May 2025 08:42:55 +0200
Subject: [PATCH 01/10] chore: Move from script tags containing dom elements to
 template tags (#8233) (#8237)

* [5.1.0dev1 release process] Bumped version to 5.1.0dev1

* [5.1.0dev1 release process] compilemessages

* [5.1.0dev1 release process] compiling new static files

* [5.1.0dev1 release process] updating latest docs

* Prepare new main branch

* Fix typos

* fix: No changes to changelog

* fix: Remove unnecessary change to migration

* Remove circular import

* Fix import order

* Re-introduce dummy `PlaceholderField` for legacy migrations

* fix: Do not assume page url cache to be filled

* fix: Structure board update sometimes failed to add all interactive elements (#8227)

* fix: Scan plugin data after structure mode Xhr load

* Fix test

* fix js linting issues

* fix: Update assets

* fix: Empty plugin selectors in all but first placeholder

* chore: Move from script tags containing dom elements to template tags

* Update cms/models/fields.py

* Update cms/models/fields.py

---------

Co-authored-by: Github Release Action <info@django-cms.org>
---
 cms/plugin_rendering.py                                   | 8 ++++----
 .../frontend/unit/fixtures/plugin_child_classes.html      | 4 ++--
 cms/tests/test_placeholder.py                             | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/cms/plugin_rendering.py b/cms/plugin_rendering.py
index d2965f61931..fae1bd780e4 100644
--- a/cms/plugin_rendering.py
+++ b/cms/plugin_rendering.py
@@ -764,9 +764,9 @@ def _preload_placeholders_for_page(self, page, slots=None, inherit=False):
 class StructureRenderer(BaseRenderer):
     load_structure = True
     placeholder_edit_template = """
-        <script data-cms id="cms-plugin-child-classes-{placeholder_id}" type="text/cms-template">
+        <template data-cms id="cms-plugin-child-classes-{placeholder_id}" type="text/cms-template">
             {plugin_menu_js}
-        </script>
+        </template>
         {plugin_js}{placeholder_js}
         """
 
@@ -853,9 +853,9 @@ class LegacyRenderer(ContentRenderer):
     placeholder_edit_template = """
         {content}
         <div class="cms-placeholder cms-placeholder-{placeholder_id}"></div>
-        <script data-cms id="cms-plugin-child-classes-{placeholder_id}" type="text/cms-template">
+        <template data-cms id="cms-plugin-child-classes-{placeholder_id}" type="text/cms-template">
             {plugin_menu_js}
-        </script>
+        </template>
         {plugin_js}{placeholder_js}
         """
 
diff --git a/cms/tests/frontend/unit/fixtures/plugin_child_classes.html b/cms/tests/frontend/unit/fixtures/plugin_child_classes.html
index 3c97d9015cf..64e5c2de1f5 100644
--- a/cms/tests/frontend/unit/fixtures/plugin_child_classes.html
+++ b/cms/tests/frontend/unit/fixtures/plugin_child_classes.html
@@ -1,4 +1,4 @@
-<script id="cms-plugin-child-classes-1" type="text/cms-template">
+<template id="cms-plugin-child-classes-1" type="text/cms-template">
     <div class="cms-submenu-item cms-submenu-item-title"><span>Accordion</span></div>
     <div class="cms-submenu-item"><a data-rel="add" href="Bootstrap3AccordionItemCMSPlugin">Accordion item</a></div>
     <div class="cms-submenu-item cms-submenu-item-title"><span>Bootstrap3</span></div>
@@ -81,4 +81,4 @@
     <div class="cms-submenu-item"><a data-rel="add" href="NewsBlogTagsPlugin">Tags</a></div>
     <div class="cms-submenu-item cms-submenu-item-title"><span>People</span></div>
     <div class="cms-submenu-item"><a data-rel="add" href="PeoplePlugin">People list</a></div>
-</script>
+</template>
diff --git a/cms/tests/test_placeholder.py b/cms/tests/test_placeholder.py
index 33764ba4110..c0c14de0199 100644
--- a/cms/tests/test_placeholder.py
+++ b/cms/tests/test_placeholder.py
@@ -1023,7 +1023,7 @@ def test_sets_source_when_external_object_is_rendered(self):
         for placeholder in declared_placeholders:
             self.assertContains(
                 response,
-                '<script data-cms id="cms-plugin-child-classes-%s" type="text/cms-template">'
+                '<template data-cms id="cms-plugin-child-classes-%s" type="text/cms-template">'
                 % placeholders.get(slot=placeholder.slot).pk,
             )
 
@@ -1046,7 +1046,7 @@ def test_sets_source_when_external_object_is_rendered(self):
         for placeholder in declared_placeholders:
             self.assertContains(
                 response,
-                '<script data-cms id="cms-plugin-child-classes-%s" type="text/cms-template">'
+                '<template data-cms id="cms-plugin-child-classes-%s" type="text/cms-template">'
                 % placeholders.get(slot=placeholder.slot).pk,
             )
 

From a9105a738d072a39d469d2f615505332040166de Mon Sep 17 00:00:00 2001
From: Peter Wischer <PeterW-LWL@users.noreply.github.com>
Date: Mon, 26 May 2025 08:58:36 +0200
Subject: [PATCH 02/10] fix: replace outdated usage of `page__node__path` with
 `page__path` (#8238)

* fix: replace outdated usage of `page__node__path` with `page__path`

* add test case for `PageContent.get_placeholder_slots()` with empty `CMS_TEMPLATES` setting

---------

Co-authored-by: Fabian Braun <fsbraun@gmx.de>
---
 cms/models/contentmodels.py |  2 +-
 cms/tests/test_admin.py     | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/cms/models/contentmodels.py b/cms/models/contentmodels.py
index 3265c5c8cc6..6a1a69d4d5d 100644
--- a/cms/models/contentmodels.py
+++ b/cms/models/contentmodels.py
@@ -226,7 +226,7 @@ def get_placeholder_slots(self):
                     self
                     .get_ancestor_titles()
                     .exclude(template=constants.TEMPLATE_INHERITANCE_MAGIC)
-                    .order_by('-page__node__path')
+                    .order_by('-page__path')
                     .values_list('template', flat=True)
                 )
                 if templates:
diff --git a/cms/tests/test_admin.py b/cms/tests/test_admin.py
index 4c724bb1dc8..04eb307f135 100644
--- a/cms/tests/test_admin.py
+++ b/cms/tests/test_admin.py
@@ -436,6 +436,18 @@ def test_template_inheritance_magic_with_three_levels_of_inheritance_inherits_fr
             child_page_content = PageContent.objects.get(page=child_page, language="en")
             self.assertEqual(child_page_content.get_template(), "nav_playground.html")
 
+    @override_settings(CMS_TEMPLATES=[])
+    def test_placeholder_slot_inheritance_magic_with_two_levels_of_inheritance_without_configured_templates(self):
+        admin_user = self.get_superuser()
+        parent_page = create_page("grandparent-page", TEMPLATE_INHERITANCE_MAGIC, "en", created_by=admin_user)
+        child_page = create_page(
+            "parent-page", TEMPLATE_INHERITANCE_MAGIC, "en", created_by=admin_user, parent=parent_page
+        )
+
+        child_slots = child_page.get_content_obj("en").get_placeholder_slots()
+
+        self.assertEqual(child_slots, ("content",))
+
 
 class AdminTests(AdminTestsBase):
     # TODO: needs tests for actual permissions, not only superuser/normaluser

From 3d069cbe542c8003881ffe2fe0c28ac0f5ed3dec Mon Sep 17 00:00:00 2001
From: Stefan Wehrmeyer <stefanw@users.noreply.github.com>
Date: Tue, 27 May 2025 08:34:51 +0200
Subject: [PATCH 03/10] fix: 404 no raised in CMS view when no URLs match
 (#8240)

* Fix raising 404 in CMS view when no URLs match

Fixes #8239

* Update cms/page_rendering.py

Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: Fabian Braun <fsbraun@gmx.de>
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
---
 cms/page_rendering.py | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/cms/page_rendering.py b/cms/page_rendering.py
index 0dccef4faf8..34035815ff6 100644
--- a/cms/page_rendering.py
+++ b/cms/page_rendering.py
@@ -61,17 +61,15 @@ def render_page(request, page, current_language, slug=None):
 
 def _handle_no_page(request):
     try:
-        # redirect to PageContent's changelist if the root page is detected
-        resolved_path = resolve(request.path)
-        if resolved_path.url_name == 'pages-root':
-            redirect_url = admin_reverse('cms_pagecontent_changelist')
-            return HttpResponseRedirect(redirect_url)
-
-        # add a $ to the end of the url (does not match on the cms anymore)
-        return resolve('%s$' % request.path).func(request)
+        match = resolve(request.path)
     except Resolver404 as e:
-        # raise a django http 404 page
-        raise Http404(dict(path=request.path, tried=e.args[0]['tried']))
+        raise Http404(dict(path=request.path, tried=e.args[0]['tried'])) from e
+
+    # redirect to PageContent's changelist if the root page is detected
+    if match.url_name == 'pages-root':
+        redirect_url = admin_reverse('cms_pagecontent_changelist')
+        return HttpResponseRedirect(redirect_url)
+    raise Http404(dict(path=request.path, tried=match.tried))
 
 
 def _handle_no_apphook(request):

From 4a12dd38a78b5b48a87646865daf6ff1df761407 Mon Sep 17 00:00:00 2001
From: Fabian Braun <fsbraun@gmx.de>
Date: Mon, 16 Jun 2025 10:16:21 +0200
Subject: [PATCH 04/10] fix: Add `default_auto_field` to cms/apps.py (#8254)

* fix: Add `default_auto_field` to cms/apps.py

* Add default_autofield to `menus.apss`
---
 cms/apps.py   | 1 +
 menus/apps.py | 1 +
 2 files changed, 2 insertions(+)

diff --git a/cms/apps.py b/cms/apps.py
index c9491bcc782..1746d3e4137 100644
--- a/cms/apps.py
+++ b/cms/apps.py
@@ -5,6 +5,7 @@
 class CMSConfig(AppConfig):
     name = 'cms'
     verbose_name = _("django CMS")
+    default_auto_field = 'django.db.models.AutoField'
 
     def ready(self):
         from cms.utils.setup import setup, setup_cms_apps
diff --git a/menus/apps.py b/menus/apps.py
index d3960c10083..2fb8382f76f 100644
--- a/menus/apps.py
+++ b/menus/apps.py
@@ -5,3 +5,4 @@
 class MenusConfig(AppConfig):
     name = 'menus'
     verbose_name = _("django CMS menus system")
+    default_auto_field = 'django.db.models.AutoField'

From bcf7f895a0f8126d382dd769147c7836a9a62831 Mon Sep 17 00:00:00 2001
From: jmit-modern <54509827+jmit-modern@users.noreply.github.com>
Date: Wed, 18 Jun 2025 01:17:04 -0700
Subject: [PATCH 05/10] add only('pk') where to get old_placeholders (#8249)

Co-authored-by: keni <v-keni@kexp.org>
Co-authored-by: Fabian Braun <fsbraun@gmx.de>
---
 cms/migrations/0027_title_placeholders_data_migration.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cms/migrations/0027_title_placeholders_data_migration.py b/cms/migrations/0027_title_placeholders_data_migration.py
index 82869c7b139..a5eec8ddabe 100644
--- a/cms/migrations/0027_title_placeholders_data_migration.py
+++ b/cms/migrations/0027_title_placeholders_data_migration.py
@@ -95,6 +95,7 @@ def forwards(apps, schema_editor):
         .using(db_alias)
         .filter(pk__in=old_placeholder_ids)
         .annotate(plugin_count=models.Count('cmsplugin'))
+        .only("pk")
     )
 
     if old_placeholders.filter(plugin_count__gt=0).exists():

From e9086eccd1d43eeac5f523b0257784f7385bf033 Mon Sep 17 00:00:00 2001
From: Stefan Wehrmeyer <stefanw@users.noreply.github.com>
Date: Wed, 18 Jun 2025 10:36:19 +0200
Subject: [PATCH 06/10] refactor: Replace inline scripts/onclick handlers
 (#8246)

Replaced with JSON data scripts and data attributes to be
conformant with Content Security Policy best practices.

Co-authored-by: Fabian Braun <fsbraun@gmx.de>
---
 cms/forms/widgets.py                          | 82 ++++++-------------
 cms/static/cms/js/modules/cms.changeform.js   |  4 +
 .../cms/js/widgets/forms.apphookselect.js     | 20 ++++-
 .../cms/js/widgets/forms.pageselectwidget.js  | 10 +--
 .../js/widgets/forms.pagesmartlinkwidget.js   | 10 +--
 cms/templates/admin/cms/page/change_form.html |  2 +-
 .../cms/widgets/applicationconfigselect.html  |  8 +-
 .../cms/widgets/pageselectwidget.html         |  4 +-
 .../cms/widgets/pagesmartlinkwidget.html      |  4 +-
 cms/tests/test_forms.py                       |  7 +-
 10 files changed, 71 insertions(+), 80 deletions(-)

diff --git a/cms/forms/widgets.py b/cms/forms/widgets.py
index 9e39b5448c9..c94ae13ecf4 100644
--- a/cms/forms/widgets.py
+++ b/cms/forms/widgets.py
@@ -74,21 +74,10 @@ def _build_widgets(self):
             Select(choices=self.choices, attrs={'style': "display:none;"}),
         )
 
-    def _build_script(self, name, value, attrs={}):
-        return rf"""<script type="text/javascript">
-                var CMS = window.CMS || {{}};
-
-                CMS.Widgets = CMS.Widgets || {{}};
-                CMS.Widgets._pageSelectWidgets = CMS.Widgets._pageSelectWidgets || [];
-                CMS.Widgets._pageSelectWidgets.push({{
-                    name: '{name}'
-                }});
-            </script>"""
-
     def get_context(self, name, value, attrs):
         self._build_widgets()
         context = super().get_context(name, value, attrs)
-        context['widget']['script_init'] = self._build_script(name, value, context['widget']['attrs'])
+        context['widget']['script_data'] = {"name": name}
         return context
 
     def format_output(self, rendered_widgets):
@@ -122,28 +111,17 @@ def get_ajax_url(self, ajax_view):
                 'You should provide an ajax_view argument that can be reversed to the PageSmartLinkWidget'
             )
 
-    def _build_script(self, name, value, attrs={}):
-        return r"""<script type="text/javascript">
-            var CMS = window.CMS || {{}};
-
-            CMS.Widgets = CMS.Widgets || {{}};
-            CMS.Widgets._pageSmartLinkWidgets = CMS.Widgets._pageSmartLinkWidgets || [];
-            CMS.Widgets._pageSmartLinkWidgets.push({{
-                id: '{element_id}',
-                text: '{placeholder_text}',
-                lang: '{language_code}',
-                url: '{ajax_url}'
-            }});
-        </script>""".format(
-            element_id=attrs.get('id', ''),
-            placeholder_text=attrs.get('placeholder_text', ''),
-            language_code=self.language,
-            ajax_url=force_str(self.ajax_url)
-        )
+    def _build_script_data(self, name, value, attrs):
+        return {
+            "id": attrs.get('id', ''),
+            "text": str(attrs.get('placeholder_text', '')),
+            "lang": self.language,
+            "url": force_str(self.ajax_url),
+        }
 
     def get_context(self, name, value, attrs):
         context = super().get_context(name, value, attrs)
-        context['widget']['script_init'] = self._build_script(name, value, context['widget']['attrs'])
+        context['widget']['script_data'] = self._build_script_data(name, value, context['widget']['attrs'])
         return context
 
 
@@ -220,10 +198,10 @@ class ApplicationConfigSelect(Select):
     Special widget -populate by javascript- that shows application configurations
     depending on selected Apphooks.
 
-    Required data are injected in the page as javascript data that cms.app_hook_select.js
+    Required data are injected in the page as JSON data that forms.apphookselect.js
     uses to create the appropriate data structure.
 
-    A stub 'add-another' link is created and filled in with the correct URL by the same
+    A stub 'addlink' link is created and filled in with the correct URL by the same
     javascript.
     """
     template_name = 'cms/widgets/applicationconfigselect.html'
@@ -237,29 +215,23 @@ def __init__(self, attrs=None, choices=(), app_configs={}):
         self.app_configs = app_configs
         super().__init__(attrs, choices)
 
-    def _build_script(self, name, value, attrs={}):
-        configs = []
-        urls = []
-        for application, cms_app in self.app_configs.items():
-            configs.append("'{}': [{}]".format(application, ",".join(
-                ["['{}', '{}']".format(config.pk, escapejs(escape(config))) for config in cms_app.get_configs()])))  # noqa
-        for application, cms_app in self.app_configs.items():
-            urls.append(f"'{application}': '{cms_app.get_config_add_url()}'")
-        return r"""<script type="text/javascript">
-            var apphooks_configuration = {{
-                {apphooks_configurations}
-            }};
-            var apphooks_configuration_url = {{
-                {apphooks_url}
-            }};
-            var apphooks_configuration_value = '{apphooks_value}';
-        </script>""".format(
-            apphooks_configurations=','.join(configs),
-            apphooks_url=','.join(urls),
-            apphooks_value=value,
-        )
+    def _build_script_data(self, name, value, attrs):
+        configs = {
+            str(application): [[str(config.pk), str(config)] for config in cms_app.get_configs()]
+            for application, cms_app in self.app_configs.items()
+        }
+        urls = {
+            str(application): cms_app.get_config_add_url()
+            for application, cms_app in self.app_configs.items()
+        }
+
+        return {
+            "apphooks_configuration": configs,
+            "apphooks_configuration_url": urls,
+            "apphooks_configuration_value": value,
+        }
 
     def get_context(self, name, value, attrs):
         context = super().get_context(name, value, attrs)
-        context['widget']['script_init'] = self._build_script(name, value, context['widget']['attrs'])
+        context['widget']['script_data'] = self._build_script_data(name, value, context['widget']['attrs'])
         return context
diff --git a/cms/static/cms/js/modules/cms.changeform.js b/cms/static/cms/js/modules/cms.changeform.js
index a4b1913bb14..0371419cf22 100644
--- a/cms/static/cms/js/modules/cms.changeform.js
+++ b/cms/static/cms/js/modules/cms.changeform.js
@@ -19,6 +19,10 @@ $(function() {
         $(this).parent('.form-row').hide();
     });
 
+    $('#page_form_lang_tabs .language_button').on('click', function() {
+        CMS.API.changeLanguage(this.dataset.adminUrl);
+    });
+
     // public api for changing the language tabs
     // used in admin/cms/page/change_form.html
     window.CMS.API.changeLanguage = function(url) {
diff --git a/cms/static/cms/js/widgets/forms.apphookselect.js b/cms/static/cms/js/widgets/forms.apphookselect.js
index 6ab08446fbe..e2d7c1278ba 100644
--- a/cms/static/cms/js/widgets/forms.apphookselect.js
+++ b/cms/static/cms/js/widgets/forms.apphookselect.js
@@ -11,7 +11,18 @@ __webpack_public_path__ = require('../modules/get-dist-path')('bundle.forms.apph
 // APP HOOK SELECT
 require.ensure([], function (require) {
     var $ = require('jquery');
-    var apphooks_configuration = window.apphooks_configuration || {};
+    var apphookData = {
+        apphooks_configuration: {},
+        apphooks_configuration_value: undefined,
+        apphooks_configuration_url: {}
+    };
+    var dataElement = document.querySelector('script[data-cms-widget-applicationconfigselect]');
+
+    if (dataElement) {
+        apphookData = JSON.parse(dataElement.querySelector('script').textContent);
+    }
+
+    var apphooks_configuration = apphookData.apphooks_configuration || {};
 
     // shorthand for jQuery(document).ready();
     $(function () {
@@ -33,7 +44,7 @@ require.ensure([], function (require) {
                 for (var i = 0; i < apphooks_configuration[opt.val()].length; i++) {
                     var selectedCfgs = '';
 
-                    if (apphooks_configuration[opt.val()][i][0] === window.apphooks_configuration_value) {
+                    if (apphooks_configuration[opt.val()][i][0] === apphookData.apphooks_configuration_value) {
                         selectedCfgs = 'selected="selected"';
                     }
                     appCfgs.append(
@@ -42,11 +53,14 @@ require.ensure([], function (require) {
                         '</option>'
                     );
                 }
-                appCfgsAdd.attr('href', window.apphooks_configuration_url[opt.val()] +
+                appCfgsAdd.attr('href', apphookData.apphooks_configuration_url[opt.val()] +
                     // Here we check if we are on django>=1.8 by checking if the method introduced in that version
                     // exists, and if it does - we add `_popup` ourselves, because otherwise the popup with
                     // apphook creation form will not be dismissed correctly
                     (window.showRelatedObjectPopup ? '?_popup=1' : ''));
+                appCfgsAdd.on('click', function () {
+                    window.showAddAnotherPopup(this);
+                });
                 appCfgsRow.removeClass('hidden');
                 appNsRow.addClass('hidden');
             } else {
diff --git a/cms/static/cms/js/widgets/forms.pageselectwidget.js b/cms/static/cms/js/widgets/forms.pageselectwidget.js
index 33ea3c20b60..5891e285682 100644
--- a/cms/static/cms/js/widgets/forms.pageselectwidget.js
+++ b/cms/static/cms/js/widgets/forms.pageselectwidget.js
@@ -82,11 +82,11 @@ require.ensure(
 
         // init
         $(function() {
-            if (window.CMS.Widgets !== undefined && window.CMS.Widgets._pageSelectWidgets !== undefined) {
-                window.CMS.Widgets._pageSelectWidgets.forEach(function (widget) {
-                    new PageSelectWidget(widget);
-                });
-            }
+            document.querySelectorAll('[data-cms-widget-pageselect]').forEach(function (el) {
+                var widget = JSON.parse(el.querySelector('script').textContent);
+
+                new PageSelectWidget(widget);
+            });
         });
     },
     'admin.widget'
diff --git a/cms/static/cms/js/widgets/forms.pagesmartlinkwidget.js b/cms/static/cms/js/widgets/forms.pagesmartlinkwidget.js
index 0c184c32d4a..932740e4f50 100644
--- a/cms/static/cms/js/widgets/forms.pagesmartlinkwidget.js
+++ b/cms/static/cms/js/widgets/forms.pagesmartlinkwidget.js
@@ -95,10 +95,10 @@ require.ensure([], function (require) {
     window.CMS.PageSmartLinkWidget = PageSmartLinkWidget;
 
     $(function () {
-        if (window.CMS.Widgets !== undefined && window.CMS.Widgets._pageSmartLinkWidgets !== undefined) {
-            window.CMS.Widgets._pageSmartLinkWidgets.forEach(function (widget) {
-                new PageSmartLinkWidget(widget);
-            });
-        }
+        document.querySelectorAll('[data-cms-widget-pagesmartlinkwidget]').forEach(function (el) {
+            var widget = JSON.parse(el.querySelector('script').textContent);
+
+            new PageSmartLinkWidget(widget);
+        });
     });
 }, 'admin.widget');
diff --git a/cms/templates/admin/cms/page/change_form.html b/cms/templates/admin/cms/page/change_form.html
index 6de5ea819cc..6a231404b5b 100644
--- a/cms/templates/admin/cms/page/change_form.html
+++ b/cms/templates/admin/cms/page/change_form.html
@@ -43,7 +43,7 @@
 {% if show_language_tabs and not show_permissions %}
 <div id="page_form_lang_tabs">
     {% for lang_code, lang_name in language_tabs %}
-        <input type="button" onclick="CMS.API.changeLanguage('{% get_admin_url_for_language cms_page lang_code %}');"
+        <input type="button" data-admin-url="{% get_admin_url_for_language cms_page lang_code %}"
             class="language_button {% if lang_code == language %}selected{% else %}{% if not lang_code in filled_languages %} notfilled{% endif %}{% endif %}"
             id="{{lang_code}}button" name="{{lang_code}}" value="{{lang_name}}" />
     {% endfor %}
diff --git a/cms/templates/cms/widgets/applicationconfigselect.html b/cms/templates/cms/widgets/applicationconfigselect.html
index a0874493954..28ec95ebba9 100644
--- a/cms/templates/cms/widgets/applicationconfigselect.html
+++ b/cms/templates/cms/widgets/applicationconfigselect.html
@@ -1,4 +1,6 @@
-{% load i18n static %}
+{% load i18n %}
 {% include 'django/forms/widgets/select.html' %}
-{{ widget.script_init|safe }}
-<a href="" class="add-another" id="add_{{ widget.name }}" onclick="return showAddAnotherPopup(this);" title="{% trans 'Add Another' %}"></a>
+<div data-cms-widget-applicationconfigselect="true" hidden>
+    {{ widget.script_data|json_script }}
+</div>
+<a href="" class="addlink" id="add_{{ widget.name }}" title="{% trans 'Add Another' %}"></a>
diff --git a/cms/templates/cms/widgets/pageselectwidget.html b/cms/templates/cms/widgets/pageselectwidget.html
index db16509a92c..3cbd3c2dcdc 100644
--- a/cms/templates/cms/widgets/pageselectwidget.html
+++ b/cms/templates/cms/widgets/pageselectwidget.html
@@ -1,2 +1,4 @@
 {% include 'django/forms/widgets/multiwidget.html' %}
-{{ widget.script_init|safe }}
+<div data-cms-widget-pageselect="true" hidden>
+    {{ widget.script_data|json_script }}
+</div>
diff --git a/cms/templates/cms/widgets/pagesmartlinkwidget.html b/cms/templates/cms/widgets/pagesmartlinkwidget.html
index 81514a118d8..411e438ed5e 100644
--- a/cms/templates/cms/widgets/pagesmartlinkwidget.html
+++ b/cms/templates/cms/widgets/pagesmartlinkwidget.html
@@ -1,2 +1,4 @@
 {% include 'django/forms/widgets/text.html' %}
-{{ widget.script_init|safe }}
+<div data-cms-widget-pagesmartlinkwidget="true" hidden>
+    {{ widget.script_data|json_script }}
+</div>
diff --git a/cms/tests/test_forms.py b/cms/tests/test_forms.py
index 251a3da1a99..7581effea38 100644
--- a/cms/tests/test_forms.py
+++ b/cms/tests/test_forms.py
@@ -232,12 +232,7 @@ def get_config_add_url(self):
         app_config_select = ApplicationConfigSelect(app_configs=app_configs)
         output = app_config_select.render("application_configurations", 1)
         self.assertFalse('<script>alert("bad-stuff");</script>' in output)
-        self.assertTrue(
-            "\\u0026lt\\u003Bscript\\u0026gt\\u003Balert("
-            "\\u0026quot\\u003Bbad\\u002Dstuff\\u0026quot"
-            "\\u003B)\\u003B\\u0026lt\\u003B/script\\u0026gt"
-            "\\u003B" in output
-        )
+        self.assertTrue('\\u003Cscript\\u003Ealert(\\"bad-stuff\\");\\u003C/script\\u003E' in output)
 
     def test_move_page_form(self):
         """Test the MovePageForm validation and behavior"""

From 6327e0f9663da417d7802755da314909ad8dfbdd Mon Sep 17 00:00:00 2001
From: Fabian Braun <fsbraun@gmx.de>
Date: Wed, 18 Jun 2025 13:12:34 +0200
Subject: [PATCH 07/10] chore: Add hash to `FuzzyInt` test class to satisfy
 ruff (#8259)

---
 cms/test_utils/util/fuzzy_int.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/cms/test_utils/util/fuzzy_int.py b/cms/test_utils/util/fuzzy_int.py
index 781dc1b7dcb..ed2b58932af 100644
--- a/cms/test_utils/util/fuzzy_int.py
+++ b/cms/test_utils/util/fuzzy_int.py
@@ -1,5 +1,3 @@
-
-
 class FuzzyInt(int):
     def __new__(cls, lowest, highest):
         obj = super().__new__(cls, highest)
@@ -12,3 +10,7 @@ def __eq__(self, other):
 
     def __repr__(self):
         return "[%d..%d]" % (self.lowest, self.highest)
+
+    def __hash__(self):
+        # Combine the hash of the lowest and highest attributes, ensuring hash consistency.
+        return hash((self.lowest, self.highest))

From ec2f4e8155f69d44da2bab67482391eea97fdc04 Mon Sep 17 00:00:00 2001
From: Fabian Braun <fsbraun@gmx.de>
Date: Tue, 24 Jun 2025 22:12:13 +0200
Subject: [PATCH 08/10] fix: Apphook widget detection (#8263)

* fix: Apphook widget detection

* Fix: Add related
---
 .../cms/js/widgets/forms.apphookselect.js     | 44 ++++++++++---------
 1 file changed, 23 insertions(+), 21 deletions(-)

diff --git a/cms/static/cms/js/widgets/forms.apphookselect.js b/cms/static/cms/js/widgets/forms.apphookselect.js
index e2d7c1278ba..38a2a9e2c90 100644
--- a/cms/static/cms/js/widgets/forms.apphookselect.js
+++ b/cms/static/cms/js/widgets/forms.apphookselect.js
@@ -10,39 +10,40 @@ __webpack_public_path__ = require('../modules/get-dist-path')('bundle.forms.apph
 // #############################################################################
 // APP HOOK SELECT
 require.ensure([], function (require) {
-    var $ = require('jquery');
-    var apphookData = {
+    const $ = require('jquery');
+    let apphookData = {
         apphooks_configuration: {},
         apphooks_configuration_value: undefined,
         apphooks_configuration_url: {}
     };
-    var dataElement = document.querySelector('script[data-cms-widget-applicationconfigselect]');
-
-    if (dataElement) {
-        apphookData = JSON.parse(dataElement.querySelector('script').textContent);
-    }
-
-    var apphooks_configuration = apphookData.apphooks_configuration || {};
 
     // shorthand for jQuery(document).ready();
     $(function () {
-        var appHooks = $('#application_urls, #id_application_urls');
-        var selected = appHooks.find('option:selected');
-        var appNsRow = $('.form-row.application_namespace, .form-row.field-application_namespace');
-        var appNs = appNsRow.find('#application_namespace, #id_application_namespace');
-        var appCfgsRow = $('.form-row.application_configs, .form-row.field-application_configs');
-        var appCfgs = appCfgsRow.find('#application_configs, #id_application_configs');
-        var appCfgsAdd = appCfgsRow.find('#add_application_configs');
-        var original_ns = appNs.val();
+        const dataElement = document.querySelector('div[data-cms-widget-applicationconfigselect]');
+
+        if (dataElement) {
+            apphookData = JSON.parse(dataElement.querySelector('script').textContent);
+        }
+
+        const apphooks_configuration = apphookData.apphooks_configuration || {};
+
+        const appHooks = $('#application_urls, #id_application_urls');
+        const selected = appHooks.find('option:selected');
+        const appNsRow = $('.form-row.application_namespace, .form-row.field-application_namespace');
+        const appNs = appNsRow.find('#application_namespace, #id_application_namespace');
+        const appCfgsRow = $('.form-row.application_configs, .form-row.field-application_configs');
+        const appCfgs = appCfgsRow.find('#application_configs, #id_application_configs');
+        const appCfgsAdd = appCfgsRow.find('#add_application_configs');
+        const original_ns = appNs.val();
 
         // Shows / hides namespace / config selection widgets depending on the user input
         appHooks.setupNamespaces = function () {
-            var opt = $(this).find('option:selected');
+            const opt = $(this).find('option:selected');
 
             if ($(appCfgs).length > 0 && apphooks_configuration[opt.val()]) {
                 appCfgs.html('');
-                for (var i = 0; i < apphooks_configuration[opt.val()].length; i++) {
-                    var selectedCfgs = '';
+                for (let i = 0; i < apphooks_configuration[opt.val()].length; i++) {
+                    let selectedCfgs = '';
 
                     if (apphooks_configuration[opt.val()][i][0] === apphookData.apphooks_configuration_value) {
                         selectedCfgs = 'selected="selected"';
@@ -58,7 +59,8 @@ require.ensure([], function (require) {
                     // exists, and if it does - we add `_popup` ourselves, because otherwise the popup with
                     // apphook creation form will not be dismissed correctly
                     (window.showRelatedObjectPopup ? '?_popup=1' : ''));
-                appCfgsAdd.on('click', function () {
+                appCfgsAdd.on('click', function (ev) {
+                    ev.preventDefault();
                     window.showAddAnotherPopup(this);
                 });
                 appCfgsRow.removeClass('hidden');

From 3651858481c7375d6faf717fb3660c975062f472 Mon Sep 17 00:00:00 2001
From: Fabian Braun <fsbraun@gmx.de>
Date: Sat, 28 Jun 2025 15:52:35 +0200
Subject: [PATCH 09/10] fix: Allow lazy wizard initialization (#8265)

* fix: Allow lazy wizard initialization

* Update cms/cms_toolbars.py

Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>

* Update cms/cms_config.py

Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
---
 cms/cms_config.py                    | 35 +++++++++++++++++++---------
 cms/cms_toolbars.py                  | 10 +++-----
 cms/tests/test_cms_config_wizards.py | 20 +++-------------
 cms/tests/test_wizards.py            |  7 +++++-
 cms/wizards/helpers.py               | 32 +++++++------------------
 cms/wizards/wizard_base.py           | 34 +++++++++++++++++++++++++++
 cms/wizards/wizard_pool.py           | 23 ++++++++----------
 docs/reference/wizards.rst           | 12 ++++------
 8 files changed, 93 insertions(+), 80 deletions(-)

diff --git a/cms/cms_config.py b/cms/cms_config.py
index 91cdd4066bb..c9c01441159 100644
--- a/cms/cms_config.py
+++ b/cms/cms_config.py
@@ -1,4 +1,5 @@
 from collections.abc import Iterable
+from functools import cached_property
 from logging import getLogger
 
 from django.core.exceptions import ImproperlyConfigured
@@ -19,9 +20,8 @@ class CMSCoreConfig(CMSAppConfig):
 
 
 class CMSCoreExtensions(CMSAppExtension):
-
     def __init__(self):
-        self.wizards = {}
+        self.lazy_wizards = []
         self.toolbar_enabled_models = {}
         self.model_groupers = {}
         self.toolbar_mixins = []
@@ -33,17 +33,30 @@ def configure_wizards(self, cms_config):
         """
         if not isinstance(cms_config.cms_wizards, Iterable):
             raise ImproperlyConfigured("cms_wizards must be iterable")
-        for wizard in cms_config.cms_wizards:
-            if not isinstance(wizard, Wizard):
+
+        self.lazy_wizards.append(cms_config.cms_wizards)
+
+    @cached_property
+    def wizards(self) -> dict[str, Wizard]:
+        """
+        Returns a dictionary of wizard instances keyed by their unique IDs.
+        Iterates over all iterables in `self.lazy_wizards`, filters out objects that are instances
+        of the `Wizard` class, and constructs a dictionary where each key is the wizard's `id`
+        and the value is the corresponding `Wizard` instance.
+        Returns:
+            dict: A dictionary mapping wizard IDs to `Wizard` instances.
+        """
+
+        wizards = {}
+        for iterable in self.lazy_wizards:
+            new_wizards = {wizard.id: wizard for wizard in iterable}
+            if wizard := next((wizard for wizard in new_wizards.values() if not isinstance(wizard, Wizard)), None):
+                # If any wizard in the iterable is not an instance of Wizard, raise an exception
                 raise ImproperlyConfigured(
-                    "All wizards defined in cms_wizards must inherit "
-                    "from cms.wizards.wizard_base.Wizard"
+                    f"cms_wizards must be iterable of Wizard instances, got {type(wizard)}"
                 )
-            elif wizard.id in self.wizards:
-                msg = f"Wizard for model {wizard.get_model()} has already been registered"
-                logger.warning(msg)
-            else:
-                self.wizards[wizard.id] = wizard
+            wizards |= new_wizards
+        return wizards
 
     def configure_toolbar_enabled_models(self, cms_config):
         if not isinstance(cms_config.cms_toolbar_enabled_models, Iterable):
diff --git a/cms/cms_toolbars.py b/cms/cms_toolbars.py
index f87b5b6dc10..73481daee0b 100644
--- a/cms/cms_toolbars.py
+++ b/cms/cms_toolbars.py
@@ -86,13 +86,9 @@ def add_wizard_button(self):
         from cms.wizards.wizard_pool import entry_choices
         title = _("Create")
 
-        if self.page:
-            user = self.request.user
-            page_pk = self.page.pk
-            disabled = len(list(entry_choices(user, self.page))) == 0
-        else:
-            page_pk = ''
-            disabled = True
+        user = self.request.user
+        page_pk = self.page.pk if self.page else ""
+        disabled = not list(entry_choices(user, self.page))
 
         url = '{url}?page={page}&language={lang}&edit'.format(
             url=admin_reverse("cms_wizard_create"),
diff --git a/cms/tests/test_cms_config_wizards.py b/cms/tests/test_cms_config_wizards.py
index f446892a9b0..09421d4d041 100644
--- a/cms/tests/test_cms_config_wizards.py
+++ b/cms/tests/test_cms_config_wizards.py
@@ -49,8 +49,10 @@ def test_raises_exception_if_doesnt_inherit_from_wizard_class(self):
         wizard = Mock(id=3, spec=object)
         cms_config = Mock(
             cms_enabled=True, cms_wizards=[wizard])
+        extensions.configure_wizards(cms_config)
         with self.assertRaises(ImproperlyConfigured):
-            extensions.configure_wizards(cms_config)
+            extensions.wizards
+
 
     def test_raises_exception_if_not_iterable(self):
         """
@@ -63,22 +65,6 @@ def test_raises_exception_if_not_iterable(self):
         with self.assertRaises(ImproperlyConfigured):
             extensions.configure_wizards(cms_config)
 
-    @patch('cms.cms_config.logger.warning')
-    def test_warning_if_registering_the_same_wizard_twice(self, mocked_logger):
-        """
-        If a wizard is already added to the dict log a warning.
-        """
-        extensions = CMSCoreExtensions()
-        wizard = Mock(id=81, spec=Wizard)
-        cms_config = Mock(
-            cms_enabled=True, cms_wizards=[wizard, wizard])
-        extensions.configure_wizards(cms_config)
-        warning_msg = f"Wizard for model {wizard.get_model()} has already been registered"
-        # Warning message displayed
-        mocked_logger.assert_called_once_with(warning_msg)
-        # wizards dict is still what we expect it to be
-        self.assertDictEqual(extensions.wizards, {81: wizard})
-
 
 class ConfigureWizardsIntegrationTestCase(CMSTestCase):
 
diff --git a/cms/tests/test_wizards.py b/cms/tests/test_wizards.py
index 681f2087690..6af83b3baab 100644
--- a/cms/tests/test_wizards.py
+++ b/cms/tests/test_wizards.py
@@ -219,7 +219,9 @@ def tearDown(self):
         # Clean up in case anything has been removed or added to the
         # registered wizards, so other tests don't have problems
         extension = apps.get_app_config('cms').cms_extension
-        extension.wizards = {}
+        # Reset the cached property 'wizards'
+        if hasattr(extension, 'wizards'):
+            del extension.wizards
         configs_with_wizards = [
             app.cms_config for app in app_registration.get_cms_config_apps()
             if hasattr(app.cms_config, 'cms_wizards')
@@ -235,6 +237,9 @@ def test_is_registered_for_registered_wizard(self):
         Test for backwards compatibility of is_registered when checking
         a registered wizard.
         """
+        from django.apps import apps
+
+        self.assertTrue(apps.get_app_config("cms").cms_extension.wizards)
         is_registered = wizard_pool.is_registered(cms_page_wizard)
         self.assertTrue(is_registered)
 
diff --git a/cms/wizards/helpers.py b/cms/wizards/helpers.py
index 3dd56d8fa78..38133425521 100644
--- a/cms/wizards/helpers.py
+++ b/cms/wizards/helpers.py
@@ -1,26 +1,12 @@
-from django.apps import apps
+import warnings
 
+from cms.utils.compat.warnings import RemovedInDjangoCMS51Warning
 
-def get_entries():
-    """
-    Returns a list of (wizard.id, wizard) tuples (for all registered
-    wizards) ordered by weight
+from .wizard_base import get_entries, get_entry  # noqa: F401
 
-    ``get_entries()`` is useful if it is required to have a list of all registered
-    wizards. Typically, this is used to iterate over them all. Note that they will
-    be returned in the order of their ``weight``: smallest numbers for weight are
-    returned first.::
-
-        for wizard_id, wizard in get_entries():
-            # do something with a wizard...
-    """
-    wizards = apps.get_app_config('cms').cms_extension.wizards
-    return [value for (key, value) in sorted(
-            wizards.items(), key=lambda e: e[1].weight)]
-
-
-def get_entry(entry_key):
-    """
-    Returns a wizard object based on its :attr:`~.cms.wizards.wizard_base.Wizard.id`.
-    """
-    return apps.get_app_config('cms').cms_extension.wizards[entry_key]
+warnings.warn(
+    "The cms.wizards.helpers module is deprecated and will be removed in django CMS 5.1. "
+    "Use cms.wizards.wizard_base.get_entries and cms.wizards.wizard_pool.get_entry instead.",
+    RemovedInDjangoCMS51Warning,
+    stacklevel=2,
+)
diff --git a/cms/wizards/wizard_base.py b/cms/wizards/wizard_base.py
index 0839cfa37e3..ac2219ae37c 100644
--- a/cms/wizards/wizard_base.py
+++ b/cms/wizards/wizard_base.py
@@ -13,6 +13,40 @@
 )
 
 
+def get_entries():
+    """
+    Returns a list of (wizard.id, wizard) tuples (for all registered
+    wizards) ordered by weight
+
+    ``get_entries()`` is useful if it is required to have a list of all registered
+    wizards. Typically, this is used to iterate over them all. Note that they will
+    be returned in the order of their ``weight``: smallest numbers for weight are
+    returned first.::
+
+        for wizard_id, wizard in get_entries():
+            # do something with a wizard...
+    """
+    wizards = apps.get_app_config('cms').cms_extension.wizards
+    return sorted(wizards.values(), key=lambda e: e.weight)
+
+
+def get_entry(entry_key):
+    """
+    Returns a wizard object based on its :attr:`~.cms.wizards.wizard_base.Wizard.id`.
+    """
+    return apps.get_app_config('cms').cms_extension.wizards[entry_key]
+
+
+def entry_choices(user, page):
+    """
+    Yields a list of wizard entries that the current user can use based on their
+    permission to add instances of the underlying model objects.
+    """
+    for entry in get_entries():
+        if entry.user_has_add_permission(user, page=page):
+            yield (entry.id, entry.title)
+
+
 class WizardBase:
     """
 
diff --git a/cms/wizards/wizard_pool.py b/cms/wizards/wizard_pool.py
index cb2e0d31305..4a669ec8362 100644
--- a/cms/wizards/wizard_pool.py
+++ b/cms/wizards/wizard_pool.py
@@ -1,24 +1,15 @@
 from django.apps import apps
 from django.utils.translation import gettext as _
 
-from cms.wizards.helpers import get_entries, get_entry
-from cms.wizards.wizard_base import Wizard
+from cms.utils.compat.warnings import RemovedInDjangoCMS51Warning
+from cms.wizards.helpers import get_entries, get_entry  # noqa: F401
+from cms.wizards.wizard_base import Wizard, entry_choices  # noqa: F401
 
 
 class AlreadyRegisteredException(Exception):
     pass
 
 
-def entry_choices(user, page):
-    """
-    Yields a list of wizard entries that the current user can use based on their
-    permission to add instances of the underlying model objects.
-    """
-    for entry in get_entries():
-        if entry.user_has_add_permission(user, page=page):
-            yield (entry.id, entry.title)
-
-
 class WizardPool:
     """
     .. deprecated:: 4.0
@@ -49,7 +40,13 @@ def register(self, entry):
         name. In this case, the register method will raise a
         ``cms.wizards.wizard_pool.AlreadyRegisteredException``.
         """
-        # TODO: Add deprecation warning
+        import warnings
+
+        warnings.warn(
+            "Using wizard_pool is deprecated. Use the cms_config instead.",
+            RemovedInDjangoCMS51Warning,
+            stacklevel=2,
+        )
         assert isinstance(entry, Wizard), "entry must be an instance of Wizard"
         if self.is_registered(entry, passive=True):
             model = entry.get_model()
diff --git a/docs/reference/wizards.rst b/docs/reference/wizards.rst
index aba8d953faf..348ba4821f6 100644
--- a/docs/reference/wizards.rst
+++ b/docs/reference/wizards.rst
@@ -39,7 +39,7 @@ When instantiating a Wizard object, use the keywords:
               CMS will create one from the pattern:
               "Create a new «model.verbose_name» instance."
 :edit_mode_on_success: Whether the user will get redirected to object edit url after a
-                       successful creation or not. This only works if the object is registered 
+                       successful creation or not. This only works if the object is registered
                        for toolbar enabled models.
 
 
@@ -78,17 +78,13 @@ Wizard class
     :members:
     :inherited-members:
 
-
-*******
-Helpers
-*******
-
-..  module:: cms.wizards.helpers
-
 ..  autofunction:: get_entry
 
 ..  autofunction:: get_entries
 
+..  autofunction:: entry_choices
+
+
 
 ***********
 wizard_pool

From 8b58e3d07bfb60a1ea64e59c892a5c24e6e20078 Mon Sep 17 00:00:00 2001
From: Fabian Braun <fsbraun@gmx.de>
Date: Sat, 28 Jun 2025 19:07:11 +0200
Subject: [PATCH 10/10] Update wizard_pool.py (#8268)

---
 cms/wizards/wizard_pool.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/cms/wizards/wizard_pool.py b/cms/wizards/wizard_pool.py
index 4a669ec8362..a125911e73c 100644
--- a/cms/wizards/wizard_pool.py
+++ b/cms/wizards/wizard_pool.py
@@ -2,8 +2,7 @@
 from django.utils.translation import gettext as _
 
 from cms.utils.compat.warnings import RemovedInDjangoCMS51Warning
-from cms.wizards.helpers import get_entries, get_entry  # noqa: F401
-from cms.wizards.wizard_base import Wizard, entry_choices  # noqa: F401
+from cms.wizards.wizard_base import Wizard, entry_choices, get_entries, get_entry  # noqa: F401
 
 
 class AlreadyRegisteredException(Exception):