Mercurial > public > sg101
comparison comments/forms.py @ 963:4619290d171d
Whitelist hot-linked image sources.
author | Brian Neal <bgneal@gmail.com> |
---|---|
date | Tue, 01 Sep 2015 20:33:40 -0500 |
parents | ee87ea74d46b |
children | 21c592cac71c |
comparison
equal
deleted
inserted
replaced
962:10e7570a3aab | 963:4619290d171d |
---|---|
5 from django import forms | 5 from django import forms |
6 from django.conf import settings | 6 from django.conf import settings |
7 from django.contrib.contenttypes.models import ContentType | 7 from django.contrib.contenttypes.models import ContentType |
8 | 8 |
9 from comments.models import Comment | 9 from comments.models import Comment |
10 from core.html import ImageCheckError | |
11 from core.html import image_check | |
12 from core.markup import site_markup | |
13 | |
10 | 14 |
11 COMMENT_MAX_LENGTH = getattr(settings, 'COMMENT_MAX_LENGTH', 3000) | 15 COMMENT_MAX_LENGTH = getattr(settings, 'COMMENT_MAX_LENGTH', 3000) |
12 | 16 |
13 class CommentForm(forms.Form): | 17 class CommentForm(forms.Form): |
14 comment = forms.CharField(label='', | 18 comment = forms.CharField(label='', |
62 if old.comment == new.comment: | 66 if old.comment == new.comment: |
63 return old | 67 return old |
64 | 68 |
65 return new | 69 return new |
66 | 70 |
71 def clean_comment(self): | |
72 comment = self.cleaned_data['comment'] | |
73 self.comment_html = None | |
74 if comment: | |
75 self.comment_html = site_markup(comment) | |
76 try: | |
77 image_check(self.comment_html) | |
78 except ImageCheckError as ex: | |
79 raise forms.ValidationError(str(ex)) | |
80 | |
81 return comment | |
82 | |
67 class Media: | 83 class Media: |
68 css = { | 84 css = { |
69 'all': (settings.GPP_THIRD_PARTY_CSS['markitup'] + | 85 'all': (settings.GPP_THIRD_PARTY_CSS['markitup'] + |
70 settings.GPP_THIRD_PARTY_CSS['jquery-ui']), | 86 settings.GPP_THIRD_PARTY_CSS['jquery-ui']), |
71 } | 87 } |