diff --git a/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst b/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst index ac981477..e7248238 100644 --- a/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst +++ b/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst @@ -24,3 +24,42 @@ Installation 3. Assign appropriate permissions to the target users/groups to be using the plugin if ``FOBI_RESTRICT_PLUGIN_ACCESS`` is set to True. + +4. Additionally, for the fine tuning, see the + ``fobi.contrib.plugins.form_elements.content.content_text.defaults`` + module. If necessary, override the settings by prepending + ``FOBI_PLUGIN_CONTENT_TEXT_`` to the desired variable name from the + above mentioned ``defaults`` module. + + By default the text field is stripped (using the awesome `bleach + `_ library. To configure the strip + behaviour, two settings are introduced: + +.. code-block:: text + + - ALLOWED_TAGS: + - ALLOWED_ATTRIBUTES: + +The default values are: + +.. code-block:: python + + ALLOWED_TAGS = [ + 'a', + 'abbr', + 'acronym', + 'b', + 'blockquote', + 'code', + 'em', + 'i', + 'li', + 'ol', + 'strong', + 'ul', + ] + + ALLOWED_ATTRIBUTES = { + 'a': ['href', 'title'], + 'img': ['src'] + } diff --git a/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py b/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py index b23de7fc..71559d4f 100644 --- a/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py +++ b/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py @@ -1,9 +1,18 @@ from django import forms from django.forms.widgets import Textarea +from django.utils.html import strip_tags from django.utils.translation import ugettext_lazy as _ from fobi.base import BasePluginForm, get_theme +from .settings import ALLOWED_TAGS, ALLOWED_ATTRIBUTES + +try: + import bleach + BLEACH_INSTALLED = True +except ImportError as err: + BLEACH_INSTALLED = False + __title__ = 'fobi.contrib.plugins.form_elements.content.content_text.forms' __author__ = 'Artur Barseghyan ' __copyright__ = '2014-2016 Artur Barseghyan' @@ -26,3 +35,16 @@ class ContentTextForm(forms.Form, BasePluginForm): required=True, widget=Textarea(attrs={'class': theme.form_element_html_class}) ) + + def clean_text(self): + """Clean text value.""" + if BLEACH_INSTALLED: + return bleach.clean( + text=self.cleaned_data['text'], + tags=ALLOWED_TAGS, + attributes=ALLOWED_ATTRIBUTES, + strip=True, + strip_comments=True + ) + else: + return strip_tags(self.cleaned_data['text'])