From aaabd813290560e8e52fd8c292548a5a42d8c6c1 Mon Sep 17 00:00:00 2001 From: Anand Doshi Date: Wed, 29 Jun 2016 12:49:07 +0530 Subject: [PATCH] [enhancement] auto-link URLs in Text Editor using bleach.linkify --- frappe/model/base_document.py | 3 +-- frappe/utils/__init__.py | 9 ++++++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/frappe/model/base_document.py b/frappe/model/base_document.py index c132a09bc9..a4539486e4 100644 --- a/frappe/model/base_document.py +++ b/frappe/model/base_document.py @@ -565,9 +565,8 @@ class BaseDocument(object): or (self.docstatus==1 and not df.get("allow_on_submit"))): continue - else: - sanitized_value = sanitize_html(value) + sanitized_value = sanitize_html(value, linkify=df.fieldtype=='Text Editor') self.set(fieldname, sanitized_value) diff --git a/frappe/utils/__init__.py b/frappe/utils/__init__.py index 832b838117..4462fe13e6 100644 --- a/frappe/utils/__init__.py +++ b/frappe/utils/__init__.py @@ -423,7 +423,7 @@ def watch(path, handler=None, debug=True): observer.stop() observer.join() -def sanitize_html(html): +def sanitize_html(html, linkify=False): """ Sanitize HTML tags, attributes and style to prevent XSS attacks Based on bleach clean, bleach whitelist and HTML5lib's Sanitizer defaults @@ -446,6 +446,9 @@ def sanitize_html(html): styles=bleach_whitelist.all_styles, strip_comments=False) + if linkify: + escaped_html = bleach.linkify(escaped_html) + return escaped_html def is_json(text): @@ -458,12 +461,12 @@ def is_json(text): else: return True -def markdown(text, sanitize=True): +def markdown(text, sanitize=True, linkify=True): html = _markdown(text) if sanitize: html = html.replace("", "") - html = sanitize_html(html) + html = sanitize_html(html, linkify=linkify) return html