M
M
MoDPhoenix2017-07-15 09:50:43
Django
MoDPhoenix, 2017-07-15 09:50:43

Django way to replace quotes on encoding inside html content?

UPD the title has changed...

Способ замены <script></script> на &lt;script&gt;&lt;/script&gt;?

I don’t know how to formulate the question correctly, maybe that’s why I didn’t find the answer myself ...
When looking for an editor for the site, I came across quilljs. A beautiful and lightweight editor, the only problem is that it saves data in its own format using json. For me, this is inconvenient and I want to save pure html in the database, and besides, the editor does not support textarea from the box.
To solve this problem, I made the following design:
var quill = new Quill('#editor', {
    theme: 'snow',
    placeholder: 'Напишите что то...',
  });

  $(document).ready( function() {
    var content = document.getElementById('id_content');
    var qlEditor = document.getElementsByClassName('ql-editor');

    if (content.value === '') {
      // Ести поле textarea пустое, вставлет пробел 
      content.value = ' ';
    } else {
      // При редактировании поста вставляет html
      // с textarea в quill редактор
      $('.ql-editor').html(content.value);
    }
  });
  // Передает html разметку с редактора в textarea
  // при отправке формы
  var form = document.querySelector('form');
  form.onsubmit = function() {
    var content = document.getElementById('id_content');
    content.value = quill.root.innerHTML;
  };

Here, the edited html code is simply taken from the editor and inserted into the textarea when submitting the form, and when editing, the reverse process occurs.
Here actually I also approached a question, there was a problem with safety. For example, you can disable js in the browser or make a POST request and write something to the textarea, for example, include scripts and styles. Since Dajngo renders html like this {{ post.content|safe }}, no escaping occurs and the scripts are simply connected to the page.
Is there any library or example of how to replace brackets < > with encoding only for script and link tags?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question