diff --git a/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst b/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst
index ac981477..e7248238 100644
--- a/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst
+++ b/src/fobi/contrib/plugins/form_elements/content/content_text/README.rst
@@ -24,3 +24,42 @@ Installation
3. Assign appropriate permissions to the target users/groups to be using
the plugin if ``FOBI_RESTRICT_PLUGIN_ACCESS`` is set to True.
+
+4. Additionally, for the fine tuning, see the
+ ``fobi.contrib.plugins.form_elements.content.content_text.defaults``
+ module. If necessary, override the settings by prepending
+ ``FOBI_PLUGIN_CONTENT_TEXT_`` to the desired variable name from the
+ above mentioned ``defaults`` module.
+
+ By default the text field is stripped (using the awesome `bleach
+ `_ library. To configure the strip
+ behaviour, two settings are introduced:
+
+.. code-block:: text
+
+ - ALLOWED_TAGS:
+ - ALLOWED_ATTRIBUTES:
+
+The default values are:
+
+.. code-block:: python
+
+ ALLOWED_TAGS = [
+ 'a',
+ 'abbr',
+ 'acronym',
+ 'b',
+ 'blockquote',
+ 'code',
+ 'em',
+ 'i',
+ 'li',
+ 'ol',
+ 'strong',
+ 'ul',
+ ]
+
+ ALLOWED_ATTRIBUTES = {
+ 'a': ['href', 'title'],
+ 'img': ['src']
+ }
diff --git a/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py b/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py
index b23de7fc..71559d4f 100644
--- a/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py
+++ b/src/fobi/contrib/plugins/form_elements/content/content_text/forms.py
@@ -1,9 +1,18 @@
from django import forms
from django.forms.widgets import Textarea
+from django.utils.html import strip_tags
from django.utils.translation import ugettext_lazy as _
from fobi.base import BasePluginForm, get_theme
+from .settings import ALLOWED_TAGS, ALLOWED_ATTRIBUTES
+
+try:
+ import bleach
+ BLEACH_INSTALLED = True
+except ImportError as err:
+ BLEACH_INSTALLED = False
+
__title__ = 'fobi.contrib.plugins.form_elements.content.content_text.forms'
__author__ = 'Artur Barseghyan '
__copyright__ = '2014-2016 Artur Barseghyan'
@@ -26,3 +35,16 @@ class ContentTextForm(forms.Form, BasePluginForm):
required=True,
widget=Textarea(attrs={'class': theme.form_element_html_class})
)
+
+ def clean_text(self):
+ """Clean text value."""
+ if BLEACH_INSTALLED:
+ return bleach.clean(
+ text=self.cleaned_data['text'],
+ tags=ALLOWED_TAGS,
+ attributes=ALLOWED_ATTRIBUTES,
+ strip=True,
+ strip_comments=True
+ )
+ else:
+ return strip_tags(self.cleaned_data['text'])