Updated UGC fields to enable escaping in MarkupFields.

jefftriplett · jefftriplett · commit 160b398436d1 · 2014-05-07T10:35:32.000-05:00
Thank you to Vinod for reporting.
diff --git a/events/models.py b/events/models.py
@@ -94,7 +94,7 @@ class Event(ContentManageable):
     title = models.CharField(max_length=200)
     calendar = models.ForeignKey(Calendar, related_name='events')
 
-    description = MarkupField(default_markup_type=DEFAULT_MARKUP_TYPE)
+    description = MarkupField(default_markup_type=DEFAULT_MARKUP_TYPE, escape_html=True)
     venue = models.ForeignKey(EventLocation, null=True, blank=True, related_name='events')
 
     categories = models.ManyToManyField(EventCategory, related_name='events', blank=True, null=True)
diff --git a/jobs/models.py b/jobs/models.py
@@ -40,7 +40,7 @@ class Job(ContentManageable):
     company = models.ForeignKey('companies.Company', related_name='jobs', blank=True, null=True)
 
     company_name = models.CharField(max_length=100, blank=True, null=True)
-    company_description = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE)
+    company_description = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE, escape_html=True)
     job_title = models.CharField(blank=True, null=True, max_length=100)
 
     city = models.CharField(max_length=100)
@@ -49,8 +49,8 @@ class Job(ContentManageable):
     location_slug = models.SlugField(max_length=350, editable=False)
     country_slug = models.SlugField(max_length=100, editable=False)
 
-    description = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE)
-    requirements = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE)
+    description = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE, escape_html=True)
+    requirements = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE, escape_html=True)
 
     contact = models.CharField(null=True, blank=True, max_length=100)
     email = models.EmailField()
diff --git a/users/models.py b/users/models.py
@@ -14,7 +14,7 @@
 
 
 class User(AbstractUser):
-    bio = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE)
+    bio = MarkupField(blank=True, default_markup_type=DEFAULT_MARKUP_TYPE, escape_html=True)
 
     SEARCH_PRIVATE = 0
     SEARCH_PUBLIC = 1
