Merge pull request #6 from aurickq/master

allow markdown in profile

requirements.txt

@@ -7,3 +7,5 @@ pyflakes==0.8.1
 rgkit==0.5.0
 uWSGI==2.0.5.1
 web.py==0.37
+Markdown==2.5.2
+bleach==1.4.1

server.py

@@ -179,11 +179,14 @@ def logout_user(sess):
 
 def template_closure(directory):
     global settings
-    templates = web.template.render(directory,
+    templates = web.template.render(
+        directory,
         globals={
             'sess': sess,
             'settings': settings,
-            'tplib': tplib})
+            'tplib': tplib,
+        },
+    )
     def render(name, *params, **kwargs):
         return getattr(templates, name)(*params, **kwargs)
     return render

t/viewrobot.html

@@ -85,7 +85,7 @@ <h1 class="no-margin">
   <h2><a href='/user/$robot.user_id'>About this programmer</a></h2>
   <div class="about">
       $if robot.about:
-          <div class="text">$robot.about</div>
+          $:tplib.safe_markdown(robot.about)
       $else:
           <div class="text"></div>
   </div>

t/viewuser.html

@@ -21,7 +21,7 @@ <h1>About the programmer</h1>
       $if tplib.is_mod(sess):
         Registered $tplib.time_ago(user.registered_on).
     </div>
-    <div class="text">$user.about</div>
+    $:tplib.safe_markdown(user.about)
   </div>
 
   <hr />

tplib.py

@@ -1,8 +1,11 @@
-import math
+import bleach
 import hashlib
-from datetime import datetime
+import markdown
+import math
 import tools
 
+from datetime import datetime
+
 ADMINS = (
     1, # bh (hehe, just use one account to be safe
 )
@@ -182,3 +185,8 @@ def rating_change(match, rid, other=False):
                                match.r2_score, match.r1_score,
                                match.k_factor)
     return round(diff, 1)
+
+def safe_markdown(string):
+    string = bleach.clean(string)
+    string = markdown.markdown(string)
+    return bleach.clean(string, tags=bleach.ALLOWED_TAGS+['p'])