diff --git a/utils/helpers.py b/utils/helpers.py index d3b42a5..3b74cb7 100644 --- a/utils/helpers.py +++ b/utils/helpers.py @@ -14,7 +14,8 @@ logger = logging.getLogger(__name__) # Allowed HTML tags and attributes for rich-text content (announcements, events, proceedings) _ALLOWED_TAGS = ['p', 'br', 'strong', 'em', 'b', 'i', 'a', 'ul', 'ol', 'li', 'h3', 'h4', 'blockquote', 'img'] -_ALLOWED_ATTRS = {'a': ['href', 'target', 'rel'], 'img': ['src', 'alt']} +_ALLOWED_ATTRS = {'a': ['href', 'target', 'rel'], 'img': ['src', 'alt', 'width', 'height', 'style']} +_ALLOWED_PROTOCOLS = ['http', 'https', 'data'] # data: for base64 inline images def sanitize_html(content): @@ -30,7 +31,7 @@ def sanitize_html(content): """ if not content: return content - return bleach.clean(content, tags=_ALLOWED_TAGS, attributes=_ALLOWED_ATTRS, strip=True) + return bleach.clean(content, tags=_ALLOWED_TAGS, attributes=_ALLOWED_ATTRS, protocols=_ALLOWED_PROTOCOLS, strip=True) def linkify_urls(html):