Made changes according to http://bugs.foocorp.net/issues/363#note-5

diff --git a/mediagoblin/edit/views.py b/mediagoblin/edit/views.py
index 2bc53a54ad4194d038368dc94c1fe77f3a7aef13..6c16a61ef5749b3d1f23be68eba2694ad59a1649 100644 (file)
--- a/mediagoblin/edit/views.py
+++ b/mediagoblin/edit/views.py
@@ -17,11 +17,13 @@
 
 from webob import exc
 
-from mediagoblin.util import render_to_response, redirect
+from mediagoblin.util import render_to_response, redirect, clean_html
 from mediagoblin.edit import forms
 from mediagoblin.edit.lib import may_edit_media
 from mediagoblin.decorators import require_active_login, get_user_media_entry
 
+import markdown
+
 
 @get_user_media_entry
 @require_active_login
@@ -49,11 +51,11 @@ def edit_media(request, media):
             media['title'] = request.POST['title']
             media['description'] = request.POST.get('description')
             
-            import markdown
             md = markdown.Markdown(
                 safe_mode = 'escape')
-            media['description_html'] = md.convert(
-                media['description'])
+            media['description_html'] = clean_html(
+                md.convert(
+                    media['description']))
 
             media['slug'] = request.POST['slug']
             media.save()

diff --git a/mediagoblin/submit/views.py b/mediagoblin/submit/views.py
index 21562e6f4235a4928929c5cf267f984eeeb1e928..437a5a517bfb756b333f0f974e72953a1f0ca313 100644 (file)
--- a/mediagoblin/submit/views.py
+++ b/mediagoblin/submit/views.py
@@ -19,11 +19,13 @@ from cgi import FieldStorage
 
 from werkzeug.utils import secure_filename
 
-from mediagoblin.util import render_to_response, redirect
+from mediagoblin.util import render_to_response, redirect, clean_html
 from mediagoblin.decorators import require_active_login
 from mediagoblin.submit import forms as submit_forms, security
 from mediagoblin.process_media import process_media_initial
 
+import markdown
+
 
 @require_active_login
 def submit_start(request):
@@ -49,11 +51,11 @@ def submit_start(request):
             entry['title'] = request.POST['title'] or unicode(splitext(filename)[0])
             entry['description'] = request.POST.get('description')
             
-            import markdown
             md = markdown.Markdown(
                 safe_mode = 'escape')
-            entry['description_html'] = md.convert(
-                entry['description'])
+            entry['description_html'] = clean_html(
+                md.convert(
+                    entry['description']))
             
             entry['media_type'] = u'image' # heh
             entry['uploader'] = request.user['_id']