added nh_safe filter in envipytags.py and updated some of the existing 'safe' to 'nh_safe'

envipath/settings.py

@@ -92,7 +92,7 @@ TEMPLATES = [
     },
 ]
 
-ALLOWED_HTML_TAGS = {'b', 'i', 'u'}
+ALLOWED_HTML_TAGS = {'b', 'i', 'u', 'a'}
 
 WSGI_APPLICATION = "envipath.wsgi.application"
 

epdb/templatetags/envipytags.py

@@ -1,4 +1,7 @@
 from django import template
+from django.conf import settings as s
+from django.utils.safestring import mark_safe
+import nh3
 
 register = template.Library()
 
@@ -6,3 +9,9 @@ register = template.Library()
 @register.filter
 def classname(obj):
     return obj.__class__.__name__
+
+
+@register.filter(name="nh_safe")
+def nh_safe(txt: str):
+    clean_html = nh3.clean(txt, tags=s.ALLOWED_HTML_TAGS)
+    return mark_safe(clean_html)

templates/objects/package.html

@@ -1,4 +1,5 @@
 {% extends "framework.html" %}
+{% load envipytags %}
 
 {% block content %}
 
@@ -29,7 +30,7 @@
             </div>
         </div>
         <div class="panel-body">
-            <p> {{ package.description|safe }} </p>
+            <p> {{ package.description|nh_safe }} </p>
         </div>
         <ul class="list-group">
             <li class="list-group-item">

templates/objects/pathway.html

@@ -1,4 +1,5 @@
 {% extends "framework.html" %}
+{% load envipytags %}
 {% load static %}
 {% block content %}
 
@@ -207,7 +208,7 @@
             </div>
             <div id="Description" class="panel-collapse collapse in">
                 <div class="panel-body list-group-item" id="DescriptionContent">
-                    {{ pathway.description | safe }}
+                    {{ pathway.description | nh_safe }}
                 </div>
             </div>
 

templates/objects/scenario.html

@@ -1,4 +1,5 @@
 {% extends "framework.html" %}
+{% load envipytags %}
 
 {% block content %}
 
@@ -52,9 +53,9 @@
 
             {% for ai in scenario.get_additional_information %}
                 <tr>
-                    <td> {{ ai.property_name|safe }} </td>
-                    <td> {{ ai.property_data|safe }} </td>
-                    <td> {{ ai.property_unit|safe }} </td>
+                    <td> {{ ai.property_name|nh_safe }} </td>
+                    <td> {{ ai.property_data|nh_safe }} </td>
+                    <td> {{ ai.property_unit|nh_safe }} </td>
                     {% if meta.can_edit %}
                     <td>
                         <form action="{% url 'package scenario detail' scenario.package.uuid scenario.uuid %}" method="post">