Add custom rich_text template filter

src/pretix/base/templatetags/rich_text.py

@@ -0,0 +1,45 @@
+import bleach
+import markdown
+from django import template
+from django.utils.safestring import mark_safe
+
+register = template.Library()
+
+ALLOWED_TAGS = [
+    'a',
+    'abbr',
+    'acronym',
+    'b',
+    'blockquote',
+    'code',
+    'em',
+    'i',
+    'li',
+    'ol',
+    'strong',
+    'ul',
+    'p',
+    'table',
+    'tbody',
+    'thead',
+    'tr',
+    'td',
+    'th',
+]
+
+ALLOWED_ATTRIBUTES = {
+    'a': ['href', 'title'],
+    'abbr': ['title'],
+    'acronym': ['title'],
+    'table': ['width'],
+    'td': ['width', 'align'],
+}
+
+
+@register.filter
+def rich_text(text: str, **kwargs):
+    """
+    Processes markdown and cleans HTML in a text input.
+    """
+    body_md = bleach.linkify(bleach.clean(markdown.markdown(text), tags=ALLOWED_TAGS, attributes=ALLOWED_ATTRIBUTES))
+    return mark_safe(body_md)

src/pretix/presale/templates/pretixpresale/event/index.html

@@ -4,7 +4,7 @@
 {% load eventurl %}
 {% load thumbnail %}
 {% load eventsignal %}
-{% load markup_tags %}
+{% load rich_text %}
 {% block title %}{% trans "Presale" %}{% endblock %}
 
 {% block content %}
@@ -69,7 +69,7 @@
         </div>
     {% endif %}
     {% if frontpage_text %}
-        {{ frontpage_text|apply_markup:"markdown"|linebreaks }}
+        {{ frontpage_text|rich_text }}
     {% endif %}
     {% eventsignal event "pretix.presale.signals.front_page_top" %}
     {% if event.presale_is_running or event.settings.show_items_outside_presale_period %}
@@ -81,7 +81,7 @@
                     {% if tup.0 %}
                         <h3>{{ tup.0.name }}</h3>
                         {% if tup.0.description %}
-                            <p>{{ tup.0.description|localize|apply_markup:"markdown" }}</p>
+                            <p>{{ tup.0.description|localize|rich_text }}</p>
                         {% endif %}
                     {% endif %}
                     {% for item in tup.1 %}
@@ -100,7 +100,7 @@
                                         <a href="#" data-toggle="variations">
                                             <strong>{{ item.name }}</strong>
                                         </a>
-                                        {% if item.description %}<p>{{ item.description|localize|apply_markup:"markdown" }}</p>
+                                        {% if item.description %}<p>{{ item.description|localize|rich_text }}</p>
                                         {% endif %}
                                     </div>
                                     <div class="col-md-2 col-xs-6 price">
@@ -176,7 +176,7 @@
                                     {% endif %}
                                     <strong>{{ item.name }}</strong>
                                     {% if item.description %}
-                                        <p class="description">{{ item.description|localize|apply_markup:"markdown" }}</p>{% endif %}
+                                        <p class="description">{{ item.description|localize|rich_text }}</p>{% endif %}
                                     {% if event.settings.show_quota_left %}
                                         {% include "pretixpresale/event/fragment_quota_left.html" with avail=item.cached_availability %}
                                     {% endif %}

src/pretix/presale/templates/pretixpresale/event/voucher.html

@@ -4,7 +4,7 @@
 {% load eventurl %}
 {% load eventsignal %}
 {% load thumbnail %}
-{% load markup_tags %}
+{% load rich_text %}
 {% block title %}{% trans "Voucher redemption" %}{% endblock %}
 
 {% block content %}
@@ -36,7 +36,7 @@
                                             </a>
                                         {% endif %}
                                         <strong>{{ item.name }}</strong>
-                                        {% if item.description %}<p>{{ item.description|localize|apply_markup:"markdown" }}</p>{% endif %}
+                                        {% if item.description %}<p>{{ item.description|localize|rich_text }}</p>{% endif %}
                                     </div>
                                     <div class="col-md-2 col-xs-6 price">
                                         {% if item.min_price != item.max_price or item.free_price %}
@@ -110,7 +110,7 @@
                                     {% endif %}
                                     <strong>{{ item.name }}</strong>
                                     {% if item.description %}
-                                        <p class="description">{{ item.description|localize|apply_markup:"markdown" }}</p>{% endif %}
+                                        <p class="description">{{ item.description|localize|rich_text }}</p>{% endif %}
                                 </div>
                                 <div class="col-md-2 col-xs-6 price">
                                     {% if item.free_price %}

src/pretix/presale/views/event.py

@@ -99,6 +99,7 @@ class EventIndex(EventViewMixin, CartMixin, TemplateView):
         context['vouchers_exist'] = vouchers_exist
 
         context['cart'] = self.get_cart()
+
         context['frontpage_text'] = str(self.request.event.settings.frontpage_text)
         return context