from django import newforms as forms
from BeautifulSoup import BeautifulSoup, Comment
class Editor2Field(forms.CharField):
widget=forms.widgets.Textarea(attrs={'dojoType': 'Editor2'})
valid_tags = 'p i strong b u a h1 h2 h3 pre br img'.split()
valid_attrs = 'href src'.split()
def clean(self, value):
"""
Cleans non-allowed HTML from the input.
"""
value = super(Editor2Field, self).clean(value)
soup = BeautifulSoup(value)
for comment in soup.findAll(
text=lambda text: isinstance(text, Comment)):
comment.extract()
for tag in soup.findAll(True):
if tag.name not in self.valid_tags:
tag.hidden = True
tag.attrs = [(attr, val) for attr, val in tag.attrs
if attr in self.valid_attrs]
return soup.renderContents().decode('utf8')
class TestForm(forms.Form):
title = forms.CharField()
content = Editor2Field()
Comments
Nice snippet!
#
This is nice, but you should also look into href attributes to make sure they don't contain javascript code.
#
marcink: Thanks for the heads up. It's obviously a fatal mistake to have left out that check.
#