Wagtailadmin form field helpers should allow HTML in help_text

The Django docs indicate that help_text should be treated as an HTML string and displayed unescaped on forms: https://docs.djangoproject.com/en/1.10/ref/models/fields/#help-text

wagtailadmin/shared/field.html does not do this, which can lead to incorrect treatment of help text that comes from Django itself. Specifically, the ‘change password’ form tries to display the AUTH_PASSWORD_VALIDATORS rules as a <ul>:

We should change our template to use {{ field.help_text|safe }} - but before we do so, we need to audit the help text of our forms to ensure that it really is HTML-safe (i.e. any < > & characters are escaped as HTML entities, and any included user-supplied strings are escaped using django.utils.html.escape()).

[Pomax]

Was there any movement on this? It would be great to be able to put proper markup in help_text and have that render as expected on that admin side still.

[harrislapiroff]

It seems to be possible to include HTML in help_text using Django’s mark_safe, e.g.,

    markdown_content = models.TextField(
        blank=True,
        null=True,
        help_text=mark_safe('This field will be processed as <a href="https://daringfireball.net/projects/markdown/">Markdown</a>.'),
    )

I guess this is considered broken because it’s inconsistent with Django’s behavior, but explicitly marking strings as safe seems like a good practice to me. Adding a note to the docs might be a quick first solution.