diff --git a/wagtail/wagtailadmin/blocks.py b/wagtail/wagtailadmin/blocks.py
index ea008f1c4..c08533daf 100644
--- a/wagtail/wagtailadmin/blocks.py
+++ b/wagtail/wagtailadmin/blocks.py
@@ -19,6 +19,8 @@ from django.forms.utils import ErrorList
import six
+from wagtail.wagtailcore.utils import escape_script
+
# helpers for Javascript expression formatting
def indent(string, depth=1):
@@ -292,6 +294,11 @@ class CharBlock(FieldBlock):
# TODO: some kwargs, such as max_length, and *possibly* things like help_text, should be passed to
# the CharField constructor. Figure out a system for doing this
+class RichTextBlock(FieldBlock):
+ def __init__(self, **kwargs):
+ from wagtail.wagtailcore.fields import RichTextArea
+ super(RichTextBlock, self).__init__(CharField(widget=RichTextArea), **kwargs)
+
# =======
# Chooser
# =======
@@ -517,7 +524,7 @@ class ListBlock(Block):
return format_html(
'',
- self.definition_prefix, list_member_html
+ self.definition_prefix, mark_safe(escape_script(list_member_html))
)
def js_initializer(self):
@@ -641,7 +648,7 @@ class BaseStreamBlock(Block):
(
self.definition_prefix,
name,
- self.render_list_member(name, child_block.default, '__PREFIX__', '')
+ mark_safe(escape_script(self.render_list_member(name, child_block.default, '__PREFIX__', '')))
)
for name, child_block in self.child_blocks.items()
]
diff --git a/wagtail/wagtailadmin/static/wagtailadmin/js/blocks/sequence.js b/wagtail/wagtailadmin/static/wagtailadmin/js/blocks/sequence.js
index 2ced19a9f..5e50b44c6 100644
--- a/wagtail/wagtailadmin/static/wagtailadmin/js/blocks/sequence.js
+++ b/wagtail/wagtailadmin/static/wagtailadmin/js/blocks/sequence.js
@@ -69,11 +69,17 @@ For example, they don't assume the presence of a 'delete' button - it's up to th
newMember._markAdded();
}
+ function elementFromTemplate(template, newPrefix) {
+ /* generate a jquery object ready to be inserted into the list, based on the passed HTML template string.
+ '__PREFIX__' will be substituted with newPrefix, and script tags escaped as <-/script> will be un-escaped */
+ return $(template.replace(/__PREFIX__/g, newPrefix).replace(/<-(-*)\/script>/g, '<$1/script>'));
+ }
+
self.insertMemberBefore = function(otherMember, template) {
newMemberPrefix = getNewMemberPrefix();
/* Create the new list member element with the real prefix substituted in */
- var elem = $(template.replace(/__PREFIX__/g, newMemberPrefix));
+ var elem = elementFromTemplate(template, newMemberPrefix);
otherMember.container.before(elem);
var newMember = SequenceMember(self, newMemberPrefix);
var index = otherMember.getIndex();
@@ -94,7 +100,7 @@ For example, they don't assume the presence of a 'delete' button - it's up to th
newMemberPrefix = getNewMemberPrefix();
/* Create the new list member element with the real prefix substituted in */
- var elem = $(template.replace(/__PREFIX__/g, newMemberPrefix));
+ var elem = elementFromTemplate(template, newMemberPrefix);
otherMember.container.after(elem);
var newMember = SequenceMember(self, newMemberPrefix);
var index = otherMember.getIndex() + 1;
@@ -119,7 +125,7 @@ For example, they don't assume the presence of a 'delete' button - it's up to th
newMemberPrefix = getNewMemberPrefix();
/* Create the new list member element with the real prefix substituted in */
- var elem = $(template.replace(/__PREFIX__/g, newMemberPrefix));
+ var elem = elementFromTemplate(template, newMemberPrefix);
list.prepend(elem);
var newMember = SequenceMember(self, newMemberPrefix);
@@ -139,7 +145,7 @@ For example, they don't assume the presence of a 'delete' button - it's up to th
newMemberPrefix = getNewMemberPrefix();
/* Create the new list member element with the real prefix substituted in */
- var elem = $(template.replace(/__PREFIX__/g, newMemberPrefix));
+ var elem = elementFromTemplate(template, newMemberPrefix);
list.append(elem);
var newMember = SequenceMember(self, newMemberPrefix);
diff --git a/wagtail/wagtailadmin/templatetags/wagtailadmin_tags.py b/wagtail/wagtailadmin/templatetags/wagtailadmin_tags.py
index cb049d0e8..650e49f35 100644
--- a/wagtail/wagtailadmin/templatetags/wagtailadmin_tags.py
+++ b/wagtail/wagtailadmin/templatetags/wagtailadmin_tags.py
@@ -1,14 +1,12 @@
from __future__ import unicode_literals
-import re
-
from django.conf import settings
from django import template
from django.contrib.humanize.templatetags.humanize import intcomma
from wagtail.wagtailcore import hooks
from wagtail.wagtailcore.models import get_navigation_menu_items, UserPagePermissionsProxy, PageViewRestriction
-from wagtail.wagtailcore.utils import camelcase_to_underscore
+from wagtail.wagtailcore.utils import camelcase_to_underscore, escape_script
from wagtail.wagtailadmin.menu import admin_menu
@@ -136,7 +134,6 @@ def usage_count_enabled():
class EscapeScriptNode(template.Node):
TAG_NAME = 'escapescript'
- SCRIPT_RE = re.compile(r'<(-*)/script>')
def __init__(self, nodelist):
super(EscapeScriptNode, self).__init__()
@@ -144,8 +141,7 @@ class EscapeScriptNode(template.Node):
def render(self, context):
out = self.nodelist.render(context)
- escaped_out = self.SCRIPT_RE.sub(r'<-\1/script>', out)
- return escaped_out
+ return escape_script(out)
@classmethod
def handle(cls, parser, token):
diff --git a/wagtail/wagtailcore/utils.py b/wagtail/wagtailcore/utils.py
index 1880684bc..52492e338 100644
--- a/wagtail/wagtailcore/utils.py
+++ b/wagtail/wagtailcore/utils.py
@@ -36,3 +36,13 @@ def resolve_model_string(model_string, default_app=None):
else:
raise LookupError("Can not resolve {0!r} into a model".format(model_string), model_string)
+
+
+SCRIPT_RE = re.compile(r'<(-*)/script>')
+def escape_script(text):
+ """
+ Escape `` tags in 'text' so that it can be placed within a `