{ "info": { "author": "Christian Kreuzberger", "author_email": "ckreuzberger@anexia-it.com", "bugtrack_url": null, "classifiers": [ "Development Status :: 5 - Production/Stable", "Environment :: Web Environment", "Framework :: Django", "Framework :: Django :: 1.11", "Framework :: Django :: 1.8", "Framework :: Django :: 2.0", "Framework :: Django :: 2.1", "Intended Audience :: Developers", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", "Programming Language :: Python", "Programming Language :: Python :: 2", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.3", "Programming Language :: Python :: 3.4", "Programming Language :: Python :: 3.5", "Programming Language :: Python :: 3.6", "Programming Language :: Python :: 3.7", "Topic :: Internet :: WWW/HTTP", "Topic :: Internet :: WWW/HTTP :: Dynamic Content" ], "description": "# Django CleanHtmlField\n\n[![image](https://travis-ci.org/anexia-it/django-cleanhtmlfield.svg?branch=master)](https://travis-ci.org/anexia-it/django-cleanhtmlfield)\n\nDjango CleanHtmlField is a simple Django application (supporting Django\n1.8, 1.11, 2.0 and 2.1) that defines an `HTMLField` that automatically\nremoves potentially malicious content. This app should work with Python\n2.7+ and Python3.4+.\n\nFor instance, if you allow the user to freely input HTML Content, and\nthe user decides to inject a JavaScript snippet:\n\n```html\n

Hello Friend

\n\n

This is for you!

\n```\n\n`HTMLField` will filter this to\n\n```html\n

Hello Friend

\n

This is for you!

\n```\n\n## Quick start\n\n1. Download and install using `pip install` from [PyPi](https://pypi.python.org/pypi/django-cleanhtmlfield/):\n\n```bash\npip install django-cleanhtmlfield\n```\n\n2. Create a field `HTMLField(strip_unsafe=True)` in your model:\n\n```python\nfrom django.db import models\nfrom django_cleanhtmlfield.fields import HTMLField\n\n\nclass MyModel(models.Model)\n some_content = HTMLField(strip_unsafe=True)\n```\n\n3. Don't forget to create and run migrations for changes on Django\n models, e.g.:\n\n\n```bash\npython manage.py makemigrations\npython manage.py migrate\n```\n\n## Requirements\n\nFor HTML content to be parsed and processed we depend on\n`BeautifulSoup4` (this is installed as a dependency). As this is a\nDjango app, it obviously requires `Django` (though we expect this to be\nalready installed).\n\nOptional: If you want a WYSIWYG Interface in your Admin Panel (or any\nother Django Form), you need the `django-ckeditor` package.\n\n![alt text](docs/ckeditor-wysiwyg.png \"CKEditor\")\n\n\n## Field options\n\n* `strip_unsafe` (Default: `False`) needs to be set to `True` to enable stripping of unsafe HTML content\n* `widget_form_class` (Default: `None`) - allows overwriting the css form class for the widget (e.g., if you want to use `django-ckeditor`)\n\n## Configuration options\n\nThe following Django Settings are available (see below for a full\nexample)\n\n - `ACCEPTABLE_ELEMENTS` - tuple that contains all allowed HTML tags\n (e.g., `'a', 'span', 'p', 'div', ...`)\n - `ACCEPTABLE_ATTRIBUTES` - tuple that contains all allowed HTMl\n attributes (e.g., `'alt', 'style', 'target', 'title',...`)\n - `ACCEPTABLE_STYLES` - tuple that contains all allowed CSS styles\n (e.g., `'background-color', 'border-color', 'font-size', ...`)\n - `REMOVE_WITH_CONTENT` - tuple that contains potentially malicious\n HTML tags that will automatically be removed (e.g., `'script',\n 'object', ...`)\n\nExample:\n\n```python\n\nACCEPTABLE_ELEMENTS = (\n 'a', 'abbr', 'acronym', 'address', 'area', 'aria-label', 'b', 'big',\n 'blockquote', 'br', 'button', 'caption', 'center', 'cite', 'code', 'col',\n 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', 'em',\n 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img',\n 'ins', 'kbd', 'label', 'legend', 'li', 'map', 'menu', 'ol',\n 'p', 'pre', 'q', 's', 'samp', 'small', 'span', 'strike',\n 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th',\n 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'iframe', 'section', 'article',\n)\n\nACCEPTABLE_ATTRIBUTES = (\n 'abbr', 'accept', 'accesskey',\n 'action', 'align', 'alt', 'axis', 'border', 'cellpadding', 'cellspacing',\n 'char', 'charoff', 'charset', 'checked', 'cite', 'class', 'clear', 'cols',\n 'colspan', 'color', 'compact', 'coords', 'data-mlang', 'data-equation', 'datetime', 'dir',\n 'enctype', 'for', 'headers', 'height', 'href', 'hreflang', 'hspace',\n 'id', 'ismap', 'label', 'lang', 'longdesc', 'maxlength', 'method',\n 'multiple', 'name', 'nohref', 'noshade', 'nowrap', 'prompt',\n 'rel', 'rev', 'rows', 'rowspan', 'role', 'rules', 'scope', 'shape', 'size', 'style',\n 'span', 'src', 'start', 'summary', 'tabindex', 'target', 'title', 'type',\n 'usemap', 'valign', 'value', 'vspace', 'width',\n)\n\nACCEPTABLE_STYLES = (\n 'background-color', 'background', 'background-image', 'background-position', 'background-size', 'background-repeat',\n 'background-attachment', 'background-origin', 'background-clip',\n 'font-family', 'font-size', 'font-weight', 'font-style', 'color',\n 'width', 'height', 'min-width', 'max-width', 'min-height', 'max-height', 'line-height',\n 'text-decoration', 'text-transform', 'text-align', 'border', 'border-style', 'border-width',\n 'border-top', 'border-bottom', 'border-left', 'border-right', 'border-top-style',\n 'border-bottom-style', 'border-left-style', 'border-right-style', 'border-top-width',\n 'border-bottom-width', 'border-left-width', 'border-right-width',\n 'border-color',\n 'border-top-color', 'border-bottom-color', 'border-left-color', 'border-spacing', 'border-collapse',\n 'border-right-color',\n 'border-radius',\n 'vertical-align', 'clear', 'float',\n 'margin', 'margin-left', 'margin-right', 'margin-top', 'margin-bottom',\n 'outline',\n 'padding', 'padding-left', 'padding-right', 'padding-top', 'padding-bottom',\n\n)\n\nREMOVE_WITH_CONTENT = ('script', 'object', 'embed', 'style', 'form', )\n```\n\n# Compatibility with Django REST Framework\n\nIf you are using Django Rest Framework you need to add the following\ncode to register a serializer/field handler:\n\n```python\nfrom django.utils.translation import ugettext_lazy as _\n\nfrom rest_framework.serializers import ModelSerializer\n\nfrom django_cleanhtmlfield.fields import HTMLField\nfrom django_cleanhtmlfield.helpers import clean_html\n\nclass RestHtmlField(fields.CharField):\n default_error_messages = {\n 'invalid': _('\"{input}\" is not a valid html.')\n }\n default_empty_html = False\n initial = False\n\n def __init__(self, **kwargs):\n super(HtmlField, self).__init__(**kwargs)\n\n def to_internal_value(self, data):\n return clean_html(data, strip_unsafe=True)\n\n\nModelSerializer.serializer_field_mapping[HTMLField] = RestHtmlField\n```\n\n# Changelog\n\n## 1.0.1\n\n- Renamed `restricted` field option to `custom_css_class`\n- Updated docs/readme\n\n## 1.0\n\n- Initial Release\n\n# License\n\n[MIT License](LICENSE)\n\n# Development and Tests\n\nThe test app is located in the `tests` subfolder. Please run tests\nagainst all Django and Python versions (e.g., using `tox` - see\n`tox.ini`).\n", "description_content_type": "", "docs_url": null, "download_url": "", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "https://github.com/anexia-it/django-cleanhtmlfield", "keywords": "", "license": "MIT", "maintainer": "", "maintainer_email": "", "name": "django-cleanhtmlfield", "package_url": "https://pypi.org/project/django-cleanhtmlfield/", "platform": "", "project_url": "https://pypi.org/project/django-cleanhtmlfield/", "project_urls": { "Homepage": "https://github.com/anexia-it/django-cleanhtmlfield" }, "release_url": "https://pypi.org/project/django-cleanhtmlfield/1.0.2/", "requires_dist": null, "requires_python": "", "summary": "A simple Django app that will give you a Cleaned HTML Field.", "version": "1.0.2" }, "last_serial": 5599020, "releases": { "1.0": [ { "comment_text": "", "digests": { "md5": "63c7b347a948f8a1e5e55c35fbab6018", "sha256": "267bf5ff9a5324a6d283570385f50f563f4ca684ee5db7ee2799070cf1901fb6" }, "downloads": -1, "filename": "django-cleanhtmlfield-1.0.tar.gz", "has_sig": false, "md5_digest": "63c7b347a948f8a1e5e55c35fbab6018", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 7173, "upload_time": "2018-11-19T11:05:39", "url": "https://files.pythonhosted.org/packages/3d/0a/b7a83043abf19e5ca4b8350a63379f93787476c22f352f0b86fa08395a37/django-cleanhtmlfield-1.0.tar.gz" } ], "1.0.1": [ { "comment_text": "", "digests": { "md5": "81088a4e40f6267cd71e822133de0a12", "sha256": "f33cdc3613f200817809115704dad1d7b40ed23de0df1e9757f76944e2c14a43" }, "downloads": -1, "filename": "django-cleanhtmlfield-1.0.1.tar.gz", "has_sig": false, "md5_digest": "81088a4e40f6267cd71e822133de0a12", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 80460, "upload_time": "2018-11-19T13:19:22", "url": "https://files.pythonhosted.org/packages/88/88/1f740a984a91415680a029606db65a28cfc7dabe517e94bf4da16e14c893/django-cleanhtmlfield-1.0.1.tar.gz" } ], "1.0.2": [ { "comment_text": "", "digests": { "md5": "a03f61322fec866784247ebe63809d84", "sha256": "31adf13ce500a5285f801e86647310aa3ff452e6d127731909a9df0c95b982f9" }, "downloads": -1, "filename": "django-cleanhtmlfield-1.0.2.tar.gz", "has_sig": false, "md5_digest": "a03f61322fec866784247ebe63809d84", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 80447, "upload_time": "2018-11-19T13:59:39", "url": "https://files.pythonhosted.org/packages/3e/78/27a83285dcd5149486417bc3616fe02213f86d216011ca5e366885acafbc/django-cleanhtmlfield-1.0.2.tar.gz" } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "a03f61322fec866784247ebe63809d84", "sha256": "31adf13ce500a5285f801e86647310aa3ff452e6d127731909a9df0c95b982f9" }, "downloads": -1, "filename": "django-cleanhtmlfield-1.0.2.tar.gz", "has_sig": false, "md5_digest": "a03f61322fec866784247ebe63809d84", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 80447, "upload_time": "2018-11-19T13:59:39", "url": "https://files.pythonhosted.org/packages/3e/78/27a83285dcd5149486417bc3616fe02213f86d216011ca5e366885acafbc/django-cleanhtmlfield-1.0.2.tar.gz" } ] }