def handle(self, *args, **kwargs):
""" On all calls, clean all notes with html and not text using html2text """
notes = Note.objects.only('static_html', 'mimetype',
'slug').filter(static_html=True).iterator()
converted_notes = 0
for note in notes:
if note.static_html and not note.is_pdf():
h = html2text.HTML2Text()
h.google_doc = True
h.escape_snob = True
h.unicode_snob = True
with default_storage.open(note.get_relative_s3_path(),
'r') as html:
markdown = h.handle(html.read().decode('utf8', 'ignore'))
if note.has_markdown():
note_markdown = note.notemarkdown
note_markdown.markdown = markdown
else:
note_markdown = NoteMarkdown(note=note,
markdown=markdown)
note_markdown.save()
converted_notes += 1
print 'Processed {n}'.format(n=note)
print 'Processed %s notes' % converted_notes
def test_note_markdown_rendering(self):
rich = NoteMarkdown(
note=self.note,
markdown="""# This is fun\n[oh](http://yeah.com)""")
rich.save()
self.assertHTMLEqual(
rich.html,
"""<h1>This is fun</h1>\n<p><a href="http://yeah.com" rel="nofollow" target="_blank">oh</a></p>"""
)
def save(self, *args, **kwargs):
# TODO: use transaction.atomic for this when we switch to Django 1.6+
instance = super(NoteForm, self).save(*args, **kwargs)
instance.tags.set(*self.cleaned_data['tags'])
if instance.is_hidden:
instance.is_hidden = False
instance.save()
if instance.is_editable() and self.cleaned_data.get('html'):
try:
note_markdown = instance.notemarkdown
except NoteMarkdown.DoesNotExist:
note_markdown = NoteMarkdown(note=instance)
note_markdown.html = self.cleaned_data['html']
note_markdown.full_clean()
note_markdown.save()
return instance
def test_note_rich_text_sanitization(self):
rich = NoteMarkdown(note=self.note,
html="""
<script>unsafe</script>
<h1 class='obtrusive'>Something</h1>
<h2>OK</h2>
&
”
<a href='javascript:alert("Oh no")'>This stuff</a>
<a href='http://google.com'>That guy</a>
""")
rich.save()
self.assertHTMLEqual(
rich.html, u"""
<h1>Something</h1>
<h2>OK</h2>
&
\u201d
<a target='_blank' rel='nofollow'>This stuff</a>
<a href="http://google.com" target="_blank" rel="nofollow">That guy</a>
""")
