inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2026-09-02 10:18:42 +00:00
Code Activity

Update server side sanitizing

Browse Source
This commit is contained in:
Oliver Walters
2026-05-25 12:27:28 +00:00
parent d93d5f9b2f
commit 725ef0458a
1 changed files with 62 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/backend/InvenTree/common/models.py
+62 -2
View File
@@ -4,6 +4,7 @@ These models are 'generic' and do not fit a particular business logic object.
""" """
import base64 import base64
import copy
import hashlib import hashlib
import hmac import hmac
import json import json
@@ -3027,8 +3028,67 @@ class Note(
def clean(self): def clean(self):
"""Clean / validate the note before saving to the database.""" """Clean / validate the note before saving to the database."""
if self.content: if self.content:
self.content = self.content.strip() attrs = copy.deepcopy(nh3.ALLOWED_ATTRIBUTES)
self.content = nh3.clean(self.content)
data_attrs = {
'data-name',
'data-level',
'data-value',
'data-style-type',
'data-editable',
}
for tag_attrs in attrs.values():
tag_attrs.update(data_attrs)
for tag in (
'span',
'p',
'div',
'img',
'a',
'h1',
'h2',
'h3',
'h4',
'h5',
'h6',
'ul',
'ol',
'li',
'blockquote',
'pre',
'table',
'thead',
'tbody',
'tr',
'td',
'th',
):
attrs.setdefault(tag, set()).update({'style'} | data_attrs)
self.content = nh3.clean(
self.content.strip(),
attributes=attrs,
filter_style_properties={
'color',
'background-color',
'font-size',
'font-weight',
'font-style',
'font-family',
'text-decoration',
'text-align',
'border',
'border-color',
'border-style',
'border-width',
'margin',
'padding',
'width',
'height',
},
)
def check_save(self): def check_save(self):
"""Check if this note can be saved.""" """Check if this note can be saved."""