Sanitize incoming html

2020-12-16 16:47:05 -08:00
parent d79a756813
commit a3c7d324d6
8 changed files with 62 additions and 11 deletions
--- a/bookwyrm/models/author.py
+++ b/bookwyrm/models/author.py
@ -25,7 +25,7 @@ class Author(ActivitypubMixin, BookWyrmModel):
    aliases = fields.ArrayField(
        models.CharField(max_length=255), blank=True, default=list
    )
-    bio = fields.TextField(null=True, blank=True)
+    bio = fields.HtmlField(null=True, blank=True)

    def save(self, *args, **kwargs):
        ''' can't be abstract for query reasons, but you shouldn't USE it '''