Django 1.6.9

[jgmize]

This supersedes #2634

[jgmize]

I pushed this to demo4 for testing and successfully ran the mcom-tests suite against it. I think we're good to go with these changes, but we may want to do a little more manual testing against demo4 before merging to be sure.

[pmclanahan]

Version in vendor too old?

[jgmize]

Right, I got an error when trying to use it with the latest bleach.

[pmclanahan]

Good to have better bleach and the bleach_tags helper, but probably not necessary for this. I'm fine w/ it though if it works and stabilizes the tests.

[jgmize]

You're probably right about bleach being overkill for plain text emails, and in hindsight I probably shouldn't have bothered, but now that the work is done I don't think it hurts anything to have that extra bit of protection.

[pmclanahan]

Maybe bleach_tags should return a safe string so we don't need all these safe filters? Is bleach the thing converting ampersands?

[jgmize]

I thought about that, and then assumed that the explicit |safe was a good thing, but maybe doing that together with renaming to bleach_safe?

Yes, bleach.clean() converts ampersands and I didn't see a way to tell it not to, so I just convert them back.

[pmclanahan]

Sounds good. Marking as safe is:

from jinja2 import Markup

def bleach_safe(text):
    return Markup(bleach.clean(text, tags=[], strip=True).replace('&', '&'))

[pmclanahan]

I'm happy to do this and resubmit if you're busy.

[pmclanahan]

I think it'd be nice to mark the return of the new bleach_tags as safe (since it is) and remove all of the safe filters where it's used. It's not a requirement though.

r+wc