Merge branch 'main' of https://github.com/HyphaApp/hypha into feature…

…/invoice-batch-actions

.github/workflows/hypha-ci.yml

@@ -101,7 +101,7 @@ jobs:
           python-version-file: ".python-version"
           cache: "pip"
           cache-dependency-path: "**/requirements*.txt"
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
       - name: install python dependencies
         run: |
           python3 -m venv venv

Makefile

@@ -1,6 +1,6 @@
 DJANGO_PORT = 9001
-JS_VENDOR_DIR = ./hypha/static_src/src/javascript/apply/vendor
-CSS_VENDOR_DIR = ./hypha/static_src/src/javascript/apply/vendor
+JS_VENDOR_DIR = ./hypha/static_src/src/javascript/vendor
+CSS_VENDOR_DIR = ./hypha/static_src/src/javascript/vendor
 JS_ESM_DIR = ./hypha/static_src/src/javascript/esm
 
 .PHONY: help

hypha/apply/activity/templates/activity/include/listing_base.html

@@ -1,4 +1,4 @@
-{% load i18n activity_tags bleach_tags markdown_tags submission_tags apply_tags heroicons %}
+{% load i18n activity_tags nh3_tags markdown_tags submission_tags apply_tags heroicons %}
 
 <div class="feed__item feed__item--{{ activity.type }} border shadow-sm rounded-sm pb-2 " id="communications#{{ activity.id }}">
     <div class="feed__pre-content hidden lg:block">
@@ -48,7 +48,7 @@
                      data-visibility="{{activity.visibility}}"
                      data-edit-url="{% url 'api:v1:comments-edit' pk=activity.pk %}"
                 >
-                    {{ activity|display_for:request.user|submission_links|markdown|bleach }}
+                    {{ activity|display_for:request.user|submission_links|markdown|nh3 }}
                 </div>
                 <style>
                     @media only screen and (min-width: 1024px){
@@ -60,7 +60,7 @@
                 <div class="js-edit-block pe-3" aria-live="polite"></div>
             {% else %}
                 <div class="px-3 prose">
-                    {{ activity|display_for:request.user|submission_links|markdown|bleach }}
+                    {{ activity|display_for:request.user|submission_links|markdown|nh3 }}
                 </div>
             {% endif %}
 

hypha/apply/activity/templates/activity/include/notifications_dropdown.html

@@ -1,4 +1,4 @@
-{% load i18n activity_tags bleach_tags markdown_tags submission_tags apply_tags %}
+{% load i18n activity_tags nh3_tags markdown_tags submission_tags apply_tags %}
 
 <div class="notifications notifications--dropdown">
     <div class="notifications__content zeta" role="activity">

hypha/apply/activity/templates/activity/notifications.html

@@ -1,6 +1,5 @@
 {% extends "base-apply.html" %}
-{% load i18n static activity_tags apply_tags bleach_tags markdown_tags submission_tags heroicons %}
-
+{% load i18n static activity_tags apply_tags nh3_tags markdown_tags submission_tags heroicons %}
 {% block content %}
     <div class="admin-bar">
         <div class="admin-bar__inner">
@@ -89,5 +88,5 @@ <h1 class="gamma heading heading--no-margin heading--bold">{% trans "Notificatio
 {% endblock %}
 
 {% block extra_js %}
-    <script src="{% static 'js/apply/tabs.js' %}"></script>
+    <script src="{% static 'js/tabs.js' %}"></script>
 {% endblock %}

hypha/apply/activity/templates/messages/email/determination.html

@@ -1,8 +1,8 @@
 {% extends "messages/email/applicant_base.html" %}
-{% load bleach_tags i18n %}
+{% load nh3_tags i18n %}
 
 {% block content %}{% trans "Your application has been reviewed and the outcome is" %}: {{ determination.clean_outcome }}
 
-    {{ determination.message|bleach|striptags }}
+    {{ determination.message|nh3|striptags }}
 
     {% trans "Read the full determination here" %}: {{ request.scheme }}://{{ request.get_host }}{{ determination.get_absolute_url }}{% endblock %}

hypha/apply/api/v1/serializers.py

@@ -1,5 +1,5 @@
 from django.contrib.auth import get_user_model
-from django_bleach.templatetags.bleach_tags import bleach_value
+from django_nh3.templatetags.nh3_tags import nh3_value
 from rest_framework import serializers
 
 from hypha.apply.activity.models import Activity
@@ -416,7 +416,7 @@ class Meta:
         )
 
     def get_message(self, obj):
-        return bleach_value(markdown_to_html(obj.message))
+        return nh3_value(markdown_to_html(obj.message))
 
     def get_editable(self, obj):
         return self.context["request"].user == obj.user

hypha/apply/dashboard/templates/dashboard/applicant_dashboard.html

@@ -1,6 +1,6 @@
 {% extends "base-apply.html" %}
 {% load render_table from django_tables2 %}
-{% load i18n static wagtailcore_tags workflow_tags statusbar_tags heroicons dashboard_statusbar_tags apply_tags invoice_tools markdown_tags bleach_tags %}
+{% load i18n static wagtailcore_tags workflow_tags statusbar_tags heroicons dashboard_statusbar_tags apply_tags invoice_tools markdown_tags nh3_tags %}
 {% block body_class %}bg-light-grey{% endblock %}
 
 {% block title %}{% trans "Dashboard" %}{% endblock %}
@@ -31,7 +31,7 @@ <h2 class="text-center font-light">{% trans "My tasks" %}</h2>
                 {% for task in my_tasks.data %}
                     <div class="bg-white p-1 flex mb-1 items-center">
                         <svg class="icon icon--dashboard-tasks"><use xlink:href="#{{ task.icon }}"></use></svg>
-                        <div class="flex-1">{{ task.text|markdown|bleach }}</div>
+                        <div class="flex-1">{{ task.text|markdown|nh3 }}</div>
                         <a class="button button-primary m-2" href="{{ task.url }}">View</a>
                     </div>
                 {% endfor %}

hypha/apply/dashboard/templates/dashboard/contracting_dashboard.html

@@ -1,6 +1,6 @@
 {% extends "base-apply.html" %}
 {% load render_table from django_tables2 %}
-{% load i18n static markdown_tags bleach_tags %}
+{% load i18n static markdown_tags nh3_tags %}
 
 {% block title %}{% trans "Dashboard" %}{% endblock %}
 
@@ -21,7 +21,7 @@ <h2 class="text-center font-light">{% trans "My tasks" %}</h2>
                 {% for task in my_tasks.data %}
                     <div class="bg-white p-1 flex mb-1 items-center">
                         <svg class="icon icon--dashboard-tasks"><use xlink:href="#{{ task.icon }}"></use></svg>
-                        <div class="flex-1">{{ task.text|markdown|bleach }}</div>
+                        <div class="flex-1">{{ task.text|markdown|nh3 }}</div>
                         <a class="button button-primary m-2" href="{{ task.url }}">View</a>
                     </div>
                 {% endfor %}
@@ -42,7 +42,7 @@ <h4 class="heading heading--normal">{% trans "PAFs for review" %}</h4>
 {% endblock %}
 
 {% block extra_js %}
-    <script src="{% static 'js/apply/url-search-params.js' %}"></script>
-    <script src="{% static 'js/apply/submission-filters.js' %}"></script>
-    <script src="{% static 'js/apply/tabs.js' %}"></script>
+    <script src="{% static 'js/url-search-params.js' %}"></script>
+    <script src="{% static 'js/submission-filters.js' %}"></script>
+    <script src="{% static 'js/tabs.js' %}"></script>
 {% endblock %}

hypha/apply/dashboard/templates/dashboard/dashboard.html

@@ -1,6 +1,6 @@
 {% extends "base-apply.html" %}
 {% load render_table from django_tables2 %}
-{% load i18n static bleach_tags markdown_tags %}
+{% load i18n static nh3_tags markdown_tags %}
 
 {% block extra_css %}
     {{ my_reviewed.filterset.form.media.css }}
@@ -30,7 +30,7 @@ <h2 class="text-center font-light">{% trans "My tasks" %}</h2>
                     {% for task in my_tasks.data %}
                         <div class="bg-white p-1 flex mb-1 items-center">
                             <svg class="icon icon--dashboard-tasks"><use xlink:href="#{{ task.icon }}"></use></svg>
-                            <div class="flex-1">{{ task.text|markdown|bleach }}</div>
+                            <div class="flex-1">{{ task.text|markdown|nh3 }}</div>
                             <a class="button button-primary m-2" href="{{ task.url }}">View</a>
                         </div>
                     {% endfor %}
@@ -124,9 +124,9 @@ <h4 class="heading heading--normal">{% trans "Active Invoices" %}</h4>
 
 {% block extra_js %}
     {{ my_reviewed.filterset.form.media.js }}
-    <script src="{% static 'js/apply/url-search-params.js' %}"></script>
-    <script src="{% static 'js/apply/all-submissions-table.js' %}"></script>
-    <script src="{% static 'js/apply/submission-filters.js' %}"></script>
-    <script src="{% static 'js/apply/tabs.js' %}"></script>
-    <script src="{% static 'js/apply/flag.js' %}"></script>
+    <script src="{% static 'js/url-search-params.js' %}"></script>
+    <script src="{% static 'js/all-submissions-table.js' %}"></script>
+    <script src="{% static 'js/submission-filters.js' %}"></script>
+    <script src="{% static 'js/tabs.js' %}"></script>
+    <script src="{% static 'js/flag.js' %}"></script>
 {% endblock %}

hypha/apply/dashboard/templates/dashboard/finance_dashboard.html

@@ -1,6 +1,6 @@
 {% extends "base-apply.html" %}
 {% load render_table from django_tables2 %}
-{% load i18n static markdown_tags bleach_tags %}
+{% load i18n static markdown_tags nh3_tags %}
 
 {% block title %}{% trans "Dashboard" %}{% endblock %}
 
@@ -21,7 +21,7 @@ <h2 class="text-center font-light">{% trans "My tasks" %}</h2>
                 {% for task in my_tasks.data %}
                     <div class="bg-white p-1 flex mb-1 items-center">
                         <svg class="icon icon--dashboard-tasks"><use xlink:href="#{{ task.icon }}"></use></svg>
-                        <div class="flex-1">{{ task.text|markdown|bleach }}</div>
+                        <div class="flex-1">{{ task.text|markdown|nh3 }}</div>
                         <a class="button button-primary m-2" href="{{ task.url }}">View</a>
                     </div>
                 {% endfor %}
@@ -109,6 +109,6 @@ <h4 class="heading heading--normal">{% trans "PAFs for review" %}</h4>
 
 {% block extra_js %}
     {{ my_reviewed.filterset.form.media.js }}
-    <script src="{% static 'js/apply/url-search-params.js' %}"></script>
-    <script src="{% static 'js/apply/submission-filters.js' %}"></script>
+    <script src="{% static 'js/url-search-params.js' %}"></script>
+    <script src="{% static 'js/submission-filters.js' %}"></script>
 {% endblock %}

hypha/apply/dashboard/templates/dashboard/reviewer_dashboard.html

@@ -83,7 +83,7 @@ <h2 class="text-xl mb-2">
 
 {% block extra_js %}
     {{ filter.form.media.js }}
-    <script src="{% static 'js/apply/url-search-params.js' %}"></script>
-    <script src="{% static 'js/apply/submission-filters.js' %}"></script>
-    <script src="{% static 'js/apply/flag.js' %}"></script>
+    <script src="{% static 'js/url-search-params.js' %}"></script>
+    <script src="{% static 'js/submission-filters.js' %}"></script>
+    <script src="{% static 'js/flag.js' %}"></script>
 {% endblock %}

hypha/apply/dashboard/wagtail_hooks.py

@@ -4,7 +4,7 @@
 from wagtail import hooks
 from wagtail.admin.menu import MenuItem
 
-from hypha.apply.home.models import ApplyHomePage
+from hypha.home.models import ApplyHomePage
 
 
 @hooks.register("register_admin_menu_item")

hypha/apply/determinations/models.py

@@ -1,4 +1,4 @@
-import bleach
+import nh3
 from django.conf import settings
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import models
@@ -130,7 +130,7 @@ class Determination(DeterminationFormFieldsMixin, AccessFormData, models.Model):
 
     @property
     def stripped_message(self):
-        return bleach.clean(self.message, tags=[], strip=True)
+        return nh3.clean(self.message, tags=set())
 
     @property
     def clean_outcome(self):

hypha/apply/determinations/templates/determinations/base_determination_form.html

@@ -1,14 +1,12 @@
 {% extends "base-apply.html" %}
-{% load i18n static bleach_tags %}
+{% load i18n static nh3_tags %}
 {% block title %}{% if object %}{% trans "Edit a Determination" %} {% if object.is_draft %}{% trans "draft" %}{% endif %}{% else %}{% trans "Create a Determination" %}{% endif %}{% endblock %}
 {% block content %}
 
-    {% block header %}
-        {% adminbar %}
-            {% slot header %}{% if object %}{% trans "Update Determination draft" %}{% else %}{% trans "Create Determination" %}{% endif %}{% endslot %}
-            {% slot sub_heading %}{% trans "For" %} <a href="{% url "funds:submissions:detail" submission.id %}">{{ submission.title }}</a>{% endslot %}
-        {% endadminbar %}
-    {% endblock %}
+    {% adminbar %}
+        {% slot header %}{% if object %}{% trans "Update Determination draft" %}{% else %}{% trans "Create Determination" %}{% endif %}{% endslot %}
+        {% slot sub_heading %}{% if submission %}{% trans "For" %} <a href="{% url "funds:submissions:detail" submission.id %}">{{ submission.title }}</a>{% endif %}{% endslot %}
+    {% endadminbar %}
 
     {% block form %}
         <section class="my-8">
@@ -56,5 +54,5 @@ <h2>{{ value }}</h2>
 
 {% block extra_js %}
     {{ field_blocks_ids|json_script:"block-ids" }}
-    <script src="{% static 'js/apply/determination-template.js' %}"></script>
+    <script src="{% static 'js/determination-template.js' %}"></script>
 {% endblock %}

hypha/apply/determinations/templates/determinations/batch_determination_form.html

@@ -3,14 +3,12 @@
 
 {% block extra_css %}
     {{ block.super }}
-    <link rel="stylesheet" href="{% static 'css/apply/fancybox.css' %}">
+    <link rel="stylesheet" href="{% static 'css/fancybox.css' %}">
 {% endblock %}
 
-{% block header %}
-    {% adminbar %}
-        {% slot header %}{% trans "Add Batch Determination" %} - {{ action_name }}{% endslot %}
-    {% endadminbar %}
-{% endblock %}
+{% adminbar %}
+    {% slot header %}{% trans "Add Batch Determination" %} - {{ action_name }}{% endslot %}
+{% endadminbar %}
 
 {% block determination_information %}
     <div class="list-reveal list-reveal--determination">
@@ -37,7 +35,7 @@
 
 {% block extra_js %}
     {{ block.super }}
-    <script src="{% static 'js/apply/jquery.fancybox.min.js' %}"></script>
-    <script src="{% static 'js/apply/batch-actions.js' %}"></script>
-    <script src="{% static 'js/apply/fancybox-global.js' %}"></script>
+    <script src="{% static 'js/jquery.fancybox.min.js' %}"></script>
+    <script src="{% static 'js/batch-actions.js' %}"></script>
+    <script src="{% static 'js/fancybox-global.js' %}"></script>
 {% endblock %}

hypha/apply/determinations/templates/determinations/determination_detail.html

@@ -1,5 +1,5 @@
 {% extends "base-apply.html" %}
-{% load i18n bleach_tags heroicons %}
+{% load i18n nh3_tags heroicons %}
 
 {% block title %}{% trans "Determination for" %} {{ determination.submission.title }}{% endblock %}
 
@@ -32,14 +32,14 @@ <h5 class="determination-outcome mb-4">
 
     <div class="rich-text rich-text--answers prose">
         <h4>{% trans "Determination message" %}</h4>
-        {{ determination.message|bleach }}
+        {{ determination.message|nh3 }}
         {% for group in determination.detailed_data.values %}
             {% if group.title %}
-                <h4>{{ group.title|bleach }}</h4>
+                <h4>{{ group.title|nh3 }}</h4>
             {% endif %}
             {% for question, answer in group.questions %}
                 <h5>{{ question }}</h5>
-                {% if answer %}{% if answer == True %}{{ answer|yesno:"Agree,Disagree" }}{% else %}{{ answer|bleach }}{% endif %}{% else %}-{% endif %}
+                {% if answer %}{% if answer == True %}{{ answer|yesno:"Agree,Disagree" }}{% else %}{{ answer|nh3 }}{% endif %}{% else %}-{% endif %}
             {% endfor %}
         {% endfor %}
     </div>

hypha/apply/determinations/templates/determinations/determination_form.html

@@ -1,11 +1,9 @@
 {% extends "determinations/base_determination_form.html" %}
 {% load i18n %}
 
-{% block header %}
-    {% adminbar %}
-        {% slot header %}
-            {% if object %}{% trans "Edit determination" %} {% if object.is_draft %}{% trans "draft" %}{% endif %}{% else %}{% trans "Create Determination" %}{% endif %}
-        {% endslot %}
-        {% slot sub_heading %}{% trans "For" %} <a class="text-blue-300 hover:underline" href="{% url "funds:submissions:detail" submission.id %}">{{ submission.title }}</a>{% endslot %}
-    {% endadminbar %}
-{% endblock %}
+{% adminbar %}
+    {% slot header %}
+        {% if object %}{% trans "Edit determination" %} {% if object.is_draft %}{% trans "draft" %}{% endif %}{% else %}{% trans "Create Determination" %}{% endif %}
+    {% endslot %}
+    {% slot sub_heading %}{% trans "For" %} <a class="text-blue-300 hover:underline" href="{% url "funds:submissions:detail" submission.id %}">{{ submission.title }}</a>{% endslot %}
+{% endadminbar %}

hypha/apply/funds/differ.py

@@ -1,7 +1,8 @@
 import re
 from difflib import SequenceMatcher
+from typing import Tuple
 
-from bleach.sanitizer import Cleaner
+import nh3
 from django.utils.html import format_html
 from django.utils.safestring import mark_safe
 
@@ -16,13 +17,26 @@ def wrap_added(text):
     return format_html('<span class="bg-green-200">{}</span>', mark_safe(text))
 
 
-def compare(answer_a, answer_b, should_bleach=True):
-    if should_bleach:
-        cleaner = Cleaner(tags=["h4"], attributes={}, strip=True)
+def compare(answer_a: str, answer_b: str, should_clean: bool = True) -> Tuple[str, str]:
+    """Compare two strings, populate diff HTML and insert it, and return a tuple of the given strings.
+
+    Args:
+        answer_a:
+            The original string
+        answer_b:
+            The string to compare to the original
+        should_clean:
+            Optional boolean to determine if the string should be sanitized with NH3 (default=True)
+
+    Returns:
+        A tuple of the original strings with diff HTML inserted.
+    """
+
+    if should_clean:
         answer_a = re.sub("(<li[^>]*>)", r"\1◦ ", answer_a)
         answer_b = re.sub("(<li[^>]*>)", r"\1◦ ", answer_b)
-        answer_a = cleaner.clean(answer_a)
-        answer_b = cleaner.clean(answer_b)
+        answer_a = nh3.clean(answer_a, tags={"h4"}, attributes={})
+        answer_b = nh3.clean(answer_b, tags={"h4"}, attributes={})
 
     diff = SequenceMatcher(None, answer_a, answer_b)
     from_diff = []

hypha/apply/funds/forms.py

@@ -3,7 +3,7 @@
 from itertools import groupby
 from operator import methodcaller
 
-import bleach
+import nh3
 from django import forms
 from django.db.models import Q
 from django.utils.safestring import mark_safe
@@ -448,7 +448,7 @@ def make_role_reviewer_fields():
     staff_reviewers = User.objects.staff().only("full_name", "pk")
 
     for role in ReviewerRole.objects.all().order_by("order"):
-        role_name = bleach.clean(role.name, strip=True)
+        role_name = nh3.clean(role.name, tags=set())
         field_name = f"role_reviewer_{role.id}"
         field = forms.ModelChoiceField(
             queryset=staff_reviewers,

hypha/apply/funds/management/commands/seed_community_lab_application.py

@@ -6,9 +6,9 @@
 
 from hypha.apply.funds.models import ApplicationForm, LabType
 from hypha.apply.funds.models.forms import LabBaseForm, LabBaseReviewForm
-from hypha.apply.home.models import ApplyHomePage
 from hypha.apply.review.models import ReviewForm
 from hypha.apply.users.groups import STAFF_GROUP_NAME
+from hypha.home.models import ApplyHomePage
 
 CL_FUND_TITLE = "Community lab (archive fund)"