0.9.14; add missing files

src/fobi/contrib/plugins/form_elements/content/content_text/README.rst

@@ -24,3 +24,42 @@ Installation
 
 3. Assign appropriate permissions to the target users/groups to be using
    the plugin if ``FOBI_RESTRICT_PLUGIN_ACCESS`` is set to True.
+
+4. Additionally, for the fine tuning, see the
+   ``fobi.contrib.plugins.form_elements.content.content_text.defaults``
+   module. If necessary, override the settings by prepending
+   ``FOBI_PLUGIN_CONTENT_TEXT_`` to the desired variable name from the
+   above mentioned ``defaults`` module.
+
+   By default the text field is stripped (using the awesome `bleach
+   <https://bleach.readthedocs.io/>`_ library. To configure the strip
+   behaviour, two settings are introduced:
+
+.. code-block:: text
+
+   - ALLOWED_TAGS:
+   - ALLOWED_ATTRIBUTES:
+
+The default values are:
+
+.. code-block:: python
+
+    ALLOWED_TAGS = [
+        'a',
+        'abbr',
+        'acronym',
+        'b',
+        'blockquote',
+        'code',
+        'em',
+        'i',
+        'li',
+        'ol',
+        'strong',
+        'ul',
+    ]
+
+    ALLOWED_ATTRIBUTES = {
+        'a': ['href', 'title'],
+        'img': ['src']
+    }

src/fobi/contrib/plugins/form_elements/content/content_text/forms.py

@@ -1,9 +1,18 @@
 from django import forms
 from django.forms.widgets import Textarea
+from django.utils.html import strip_tags
 from django.utils.translation import ugettext_lazy as _
 
 from fobi.base import BasePluginForm, get_theme
 
+from .settings import ALLOWED_TAGS, ALLOWED_ATTRIBUTES
+
+try:
+    import bleach
+    BLEACH_INSTALLED = True
+except ImportError as err:
+    BLEACH_INSTALLED = False
+
 __title__ = 'fobi.contrib.plugins.form_elements.content.content_text.forms'
 __author__ = 'Artur Barseghyan <artur.barseghyan@gmail.com>'
 __copyright__ = '2014-2016 Artur Barseghyan'
@@ -26,3 +35,16 @@ class ContentTextForm(forms.Form, BasePluginForm):
         required=True,
         widget=Textarea(attrs={'class': theme.form_element_html_class})
     )
+
+    def clean_text(self):
+        """Clean text value."""
+        if BLEACH_INSTALLED:
+            return bleach.clean(
+                text=self.cleaned_data['text'],
+                tags=ALLOWED_TAGS,
+                attributes=ALLOWED_ATTRIBUTES,
+                strip=True,
+                strip_comments=True
+            )
+        else:
+            return strip_tags(self.cleaned_data['text'])