From a1e66369f5afd4923c8f91fd888a58c7c7d8e9d9 Mon Sep 17 00:00:00 2001 From: JamieH Date: Tue, 13 Sep 2016 15:25:08 +0100 Subject: [PATCH] Fix XSS in the preview functionality By default this library uses the including preview page, which doesn't make use of the markdown_safe function. I changed the page to use markdown_safe so that this page wouldn't allow XSS by default. --- django_markdown/templates/django_markdown/preview.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/django_markdown/templates/django_markdown/preview.html b/django_markdown/templates/django_markdown/preview.html index 718cadb..836b3a9 100644 --- a/django_markdown/templates/django_markdown/preview.html +++ b/django_markdown/templates/django_markdown/preview.html @@ -9,7 +9,7 @@ -{{ content|markdown }} +{{ content|markdown_safe }}