diff --git a/CHANGELOG.txt b/CHANGELOG.txt index cfc88d71a..5c1a4c826 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -22,6 +22,7 @@ Changelog * StreamField blocks are now added automatically, without showing the block types menu, if only one block type exists (Alex Gleason) * Wagtail admin now standardises on a single thumbnail image size, to reduce the overhead of creating multiple renditions * The `first_published_at` and `latest_revision_created_at` fields on page models are now available as filter fields on search queries + * Rich text fields now strip out HTML comments * Fix: Deleting a page permission from the groups admin UI does not immediately submit the form * Fix: Wagtail userbar is shown on pages that do not pass a `page` variable to the template (e.g. because they override the `serve` method) * Fix: request.site now set correctly on page preview when the page is not in the default site diff --git a/docs/releases/1.2.rst b/docs/releases/1.2.rst index 3c291ecd4..64d8bbcea 100644 --- a/docs/releases/1.2.rst +++ b/docs/releases/1.2.rst @@ -54,6 +54,7 @@ Minor features * StreamField blocks are now added automatically, without showing the block types menu, if only one block type exists (Alex Gleason) * The ``first_published_at`` and ``latest_revision_created_at`` fields on page models are now available as filter fields on search queries * Wagtail admin now standardises on a single thumbnail image size, to reduce the overhead of creating multiple renditions + * Rich text fields now strip out HTML comments Bug fixes ~~~~~~~~~ diff --git a/wagtail/wagtailcore/tests/test_whitelist.py b/wagtail/wagtailcore/tests/test_whitelist.py index ce2ff44b8..26193a4fe 100644 --- a/wagtail/wagtailcore/tests/test_whitelist.py +++ b/wagtail/wagtailcore/tests/test_whitelist.py @@ -143,3 +143,8 @@ class TestWhitelister(TestCase): string = 'snowman Yorkshire' cleaned_string = Whitelister.clean(string) self.assertEqual(cleaned_string, 'snowman Yorkshire') + + def test_clean_comments(self): + string = 'snowman Yorkshire' + cleaned_string = Whitelister.clean(string) + self.assertEqual(cleaned_string, 'snowman Yorkshire') diff --git a/wagtail/wagtailcore/whitelist.py b/wagtail/wagtailcore/whitelist.py index 3f521275a..653e0c124 100644 --- a/wagtail/wagtailcore/whitelist.py +++ b/wagtail/wagtailcore/whitelist.py @@ -3,7 +3,7 @@ A generic HTML whitelisting engine, designed to accommodate subclassing to overr specific rules. """ import re -from bs4 import BeautifulSoup, NavigableString, Tag +from bs4 import BeautifulSoup, NavigableString, Tag, Comment ALLOWED_URL_SCHEMES = ['http', 'https', 'ftp', 'mailto', 'tel'] @@ -111,7 +111,12 @@ class Whitelister(object): cls.clean_unknown_node(doc, node) @classmethod - def clean_string_node(cls, doc, str): + def clean_string_node(cls, doc, node): + # Remove comments + if isinstance(node, Comment): + node.extract() + return + # by default, nothing needs to be done to whitelist string nodes pass