Clean strings in comments before displaying

cps/clean_html.py

@@ -35,7 +35,7 @@ def clean_string(unsafe_text, book_id=0):
     try:
         if bleach:
             allowed_tags = list(ALLOWED_TAGS)
-            allowed_tags.extend(["p", "span", "div", "pre", "br", "h1", "h2", "h3", "h4", "h5", "h6"])
+            allowed_tags.extend(["p", "span", "div", "pre", "br", "h1", "h2", "h3", "h4", "h5", "h6", "img"])
             safe_text = clean_html(unsafe_text, tags=set(allowed_tags))
         else:
             safe_text = clean_html(unsafe_text)

cps/jinjia.py

@@ -30,6 +30,7 @@ from uuid import uuid4
 from flask import Blueprint, request, url_for, g
 from flask_babel import format_date
 from .cw_login import current_user
+from .clean_html import clean_string as html_clean_string
 
 from . import constants, logger
 
@@ -181,3 +182,9 @@ def contains_music(book_formats):
         if format.format.lower() in g.constants.EXTENSIONS_AUDIO:
             result = True
     return result
+
+@jinjia.app_template_filter('clean_string')
+def clean_string(unsafe_text):
+    return html_clean_string(unsafe_text)
+
+

cps/templates/basic_detail.html

@@ -74,7 +74,7 @@
 {% if entry.comments|length > 0 and entry.comments[0].text|length > 0 %}
     <div>
         <h2 id="decription">{{ _('Description:') }}</h2>
-        {{ entry.comments[0].text|safe }}
+        {{ entry.comments[0].text|clean_string|safe }}
     </div>
 {% endif %}
 </div>

cps/templates/detail.html

@@ -284,7 +284,7 @@
             {% if entry.comments|length > 0 and entry.comments[0].text|length > 0 %}
                 <div class="comments">
                     <h3 id="decription">{{ _('Description:') }}</h3>
-                    {{ entry.comments[0].text|safe }}
+                    {{ entry.comments[0].text|clean_string|safe }}
                 </div>
             {% endif %}
 

cps/templates/listenmp3.html

@@ -175,7 +175,7 @@
       {% if entry.comments|length > 0 and entry.comments[0].text|length > 0%}
         <div class="comments">
             <h3 id="decription">{{_('Description:')}}</h3>
-            {{entry.comments[0].text|safe}}
+            {{entry.comments[0].text|clean_string|safe}}
         </div>
       {% endif %}