feat(admin): edit category content in the admin form behind the HTML gate

- add a content textarea (size huge) after description, with en and pl phrases
- add content to Category.Fillable
- export classes.CheckHTML and run it from FormBeforeCreate and FormBeforeUpdate:
  unsafe category content answers 422 on content, blank content is stored as NULL
This commit is contained in:
2026-10-09 16:26:12 +02:00
parent 740dcd086d
commit f22d08902e
10 changed files with 249 additions and 4 deletions

View File

@@ -37,6 +37,13 @@ func FormatHTML(src string) (string, error) {
return html, nil
}
// CheckHTML applies the FormatHTML safety gate to HTML that is stored as is,
// such as category content. It refuses raw script, iframe, object and embed
// tags, event handler attributes and javascript, vbscript or data URL schemes.
func CheckHTML(html string) error {
return rejectUnsafe(html)
}
func rejectUnsafe(html string) error {
if markdownUnsafeTag.MatchString(html) {
return fmt.Errorf("journal: rendered HTML contains raw unsafe tags")