wcs: display richtext field as safe (#69271)

combo/apps/wcs/templates/combo/wcs/card-field-value.html

@@ -1,6 +1,12 @@
 {% load combo %}{% spaceless %}
-{% if field.type == "text" and mode != 'inline' and value %}
-<div class="value">{{ field|format_text:value }}</div>
+{% if field.type == "text" and field.display_mode == 'rich' and value %}
+  {% if cell.display_mode == 'table' or cell.display_mode == 'card' and item.display_mode == 'text' %}
+    <div class="value">{{ value|safe }}</div>
+  {% else %}
+    {{ value|striptags }}
+  {% endif %}
+{% elif field.type == "text" and mode != 'inline' and value %}
+  <div class="value">{{ field|format_text:value }}</div>
 {% else %}
 {% if not mode == 'inline' %}<div class="value">{% endif %}
 {% if field.type == "date" %}

combo/apps/wcs/templatetags/wcs.py

@@ -31,7 +31,7 @@ register = template.Library()
 
 @register.filter
 def format_text(field, value):
-    if field.get('pre'):
+    if field.get('display_mode') == 'pre':
         return mark_safe('<pre>%s</pre>' % escape(value))
     return mark_safe('<p>' + '\n'.join([(escape(x) or '</p><p>') for x in value.splitlines()]) + '</p>')
 

combo/manager/static/js/combo.manager.js

@@ -876,6 +876,9 @@ Card_cell_custom.prototype = {
         schema_cell.varname = form_datas.field_varname;
         schema_cell.field_content = form_datas.field_content;
         schema_cell.display_mode = form_datas.field_display_mode;
+        if (form_datas.field_content == 'label-and-value') {
+          schema_cell.display_mode = 'text';
+        }
         if (form_datas.field_empty_display_mode == '@custom@') {
           schema_cell.empty_value = form_datas.field_empty_text;
         } else {

tests/wcs/test_card.py

@@ -855,6 +855,7 @@ def test_card_cell_table_mode_render_custom_schema_card_field(mock_send, context
         {'varname': 'fieldf'},
         {'varname': 'fieldg'},
         {'varname': 'fieldh'},
+        {'varname': 'fieldi'},
         {'varname': 'unknown'},
         {'varname': 'user:name'},
         {'varname': 'user:email'},
@@ -867,7 +868,7 @@ def test_card_cell_table_mode_render_custom_schema_card_field(mock_send, context
 
     result = cell.render(context)
     assert PyQuery(result).find('ul li') == []
-    assert len(PyQuery(result).find('table tr td')) == 13 * 3
+    assert len(PyQuery(result).find('table tr td')) == 14 * 3
     assert [PyQuery(td).text() for td in PyQuery(result).find('table tr:first-child td')] == [
         '<i>a</i>',
         'yes',
@@ -878,6 +879,7 @@ def test_card_cell_table_mode_render_custom_schema_card_field(mock_send, context
         "lorem<strong>ipsum hello world",
         'test@localhost',
         'https://www.example.net/',
+        "loremipsum\nhello'world",
         'User Foo Bar',
         'foo@bar.com',
         'User',
@@ -895,9 +897,14 @@ def test_card_cell_table_mode_render_custom_schema_card_field(mock_send, context
         PyQuery(result).find('table tr:first-child td:nth-child(9) a').attr['href']
         == 'https://www.example.net/'
     )
-    assert PyQuery(result).find('table tr:first-child td:nth-child(11) a').text().strip() == 'foo@bar.com'
+    assert PyQuery(result).find('table tr:first-child td:nth-child(10) p:first-child').text() == 'loremipsum'
     assert (
-        PyQuery(result).find('table tr:first-child td:nth-child(11) a').attr['href'] == 'mailto:foo@bar.com'
+        PyQuery(result).find('table tr:first-child td:nth-child(10) p:first-child strong').text() == 'ipsum'
+    )
+    assert PyQuery(result).find('table tr:first-child td:nth-child(10) p:last-child').text() == "hello'world"
+    assert PyQuery(result).find('table tr:first-child td:nth-child(12) a').text().strip() == 'foo@bar.com'
+    assert (
+        PyQuery(result).find('table tr:first-child td:nth-child(12) a').attr['href'] == 'mailto:foo@bar.com'
     )
 
 
@@ -1737,6 +1744,28 @@ def test_card_cell_card_mode_render_custom_schema_card_field(mock_send, context)
     assert PyQuery(result).find('.label').text() == 'Field F'
     assert PyQuery(result).find('.value pre').text() == 'lorem<strong>ipsum hello world'
 
+    cell.custom_schema['cells'][0] = {
+        'varname': 'fieldi',
+        'field_content': 'label-and-value',
+        'display_mode': 'text',
+    }
+    cell.save()
+    result = cell.render(context)
+    assert PyQuery(result).find('.label').text() == 'Field I'
+    assert PyQuery(result).find('.value p:first-child').text() == 'loremipsum'
+    assert PyQuery(result).find('.value p:first-child strong').text() == 'ipsum'
+    assert PyQuery(result).find('.value p:last-child').text() == "hello'world"
+
+    cell.custom_schema['cells'][0] = {
+        'varname': 'fieldi',
+        'field_content': 'value',
+        'display_mode': 'title',
+    }
+    cell.save()
+    result = cell.render(context)
+    assert PyQuery(result).find('h3').text() == "loremipsumhello'world"
+    assert PyQuery(result).find('h3 p') == []  # content was stripped
+
     cell.custom_schema['cells'][0] = {
         'varname': 'fieldg',
         'field_content': 'label-and-value',

tests/wcs/utils.py

@@ -106,6 +106,7 @@ WCS_CARDS_DATA = {
                 'fieldf': 'lorem<strong>ipsum\n\nhello world',
                 'fieldg': 'test@localhost',
                 'fieldh': 'https://www.example.net/',
+                'fieldi': "<p>lorem<strong>ipsum</p><p>hello'world</p>",
                 'related': 'Foo Bar',
                 'related_raw': 42,
                 'related_structured': {'id': 42, 'text': 'blah'},
@@ -227,9 +228,10 @@ WCS_CARDDEF_SCHEMAS = {
             {'label': 'Field C', 'varname': 'fieldc', 'type': 'date'},
             {'label': 'Field D', 'varname': 'fieldd', 'type': 'file'},
             {'label': 'Field E', 'varname': 'fielde', 'type': 'text'},
-            {'label': 'Field F', 'varname': 'fieldf', 'type': 'text', 'pre': True},
+            {'label': 'Field F', 'varname': 'fieldf', 'type': 'text', 'display_mode': 'pre'},
             {'label': 'Field G', 'varname': 'fieldg', 'type': 'email'},
             {'label': 'Field H', 'varname': 'fieldh', 'type': 'string'},
+            {'label': 'Field I', 'varname': 'fieldi', 'type': 'text', 'display_mode': 'rich'},
             {'label': 'Empty', 'varname': 'empty', 'type': 'string'},
             {'label': 'Related', 'varname': 'related', 'type': 'item'},
             {'label': 'Page', 'type': 'page'},