diff --git a/agents/notebook/views.py b/agents/notebook/views.py
index 492631808f4cc19194c5c32ab2b8bee330f3e808..7779f71798add544d2953b5df5bc4e7c41aa9c60 100644
--- a/agents/notebook/views.py
+++ b/agents/notebook/views.py
@@ -12,7 +12,7 @@ router = APIRouter()
templates = Jinja2Templates(directory="notebook/templates")
storage = Storage()
-allowed_tags = ['b', 'i', 'a']
+allowed_tags = ['b', 'i', 'a', 'ol', 'ul', 'li', 'dl', 'dt', 'dd', 'table', 'caption', 'tr', 'th', 'td']
allowed_attributes = {
'a': ['href', 'title']
}
diff --git a/hf_repo/agents/notebook/views.py b/hf_repo/agents/notebook/views.py
index 2976e44700e87ab3a4f7b0de4303cbfc54ee6fa5..7779f71798add544d2953b5df5bc4e7c41aa9c60 100644
--- a/hf_repo/agents/notebook/views.py
+++ b/hf_repo/agents/notebook/views.py
@@ -1,5 +1,7 @@
# agents/notebook/views.py
+import bleach
+
from fastapi import APIRouter, Request, Form
from fastapi.responses import RedirectResponse, HTMLResponse
from fastapi.templating import Jinja2Templates
@@ -10,6 +12,14 @@ router = APIRouter()
templates = Jinja2Templates(directory="notebook/templates")
storage = Storage()
+allowed_tags = ['b', 'i', 'a', 'ol', 'ul', 'li', 'dl', 'dt', 'dd', 'table', 'caption', 'tr', 'th', 'td']
+allowed_attributes = {
+ 'a': ['href', 'title']
+}
+
+def sanitize_html(text):
+ return bleach.clean(text, tags=allowed_tags, attributes=allowed_attributes, strip=True)
+
@router.get("/chat")
def chat_page(request: Request):
did = request.session.get("did")
@@ -72,7 +82,7 @@ def post_message(
if text.strip():
storage.write_note(
- content=text.strip(),
+ content=sanitize_html(text.strip()),
user_did=did,
source="user",
hidden=is_hidden
diff --git a/hf_repo/agents/requirements.txt b/hf_repo/agents/requirements.txt
index a63403550b2c5653989211469ee0a08a48065867..c515e968c47a5ffa70ce17857ce182ab4c5295e8 100644
--- a/hf_repo/agents/requirements.txt
+++ b/hf_repo/agents/requirements.txt
@@ -12,4 +12,5 @@ jinja2
python-multipart
passlib[bcrypt]
werkzeug
-itsdangerous
\ No newline at end of file
+itsdangerous
+bleach
\ No newline at end of file
diff --git a/hf_repo/hf_repo/agents/notebook/templates/messages.html b/hf_repo/hf_repo/agents/notebook/templates/messages.html
index 8b6c076dad77c38f5846dd71252100836e2c4379..3df3b2d777024accdd96f1d91091cc41e7609143 100644
--- a/hf_repo/hf_repo/agents/notebook/templates/messages.html
+++ b/hf_repo/hf_repo/agents/notebook/templates/messages.html
@@ -46,10 +46,10 @@
Источник: {{ msg.source }} — {{ msg.timestamp[:19].replace('T', ' ') }}
- {{ msg.badges }}Пользователь: {% if msg.username %}{{ msg.username }}{% endif %} {% if msg.user_did !="" %}({{ msg.user_did }}){% endif %}
+ {% if msg.badges %}{{ msg.badges }}{% endif %}Пользователь: {% if msg.username %}{{ msg.username }}{% endif %} {% if msg.user_did %}({{ msg.user_did }}){% endif %}
- {{ msg.text }}
+ {{ msg.text|safe }}
{% endfor %}
diff --git a/hf_repo/hf_repo/hf_repo/agents/tools/storage.py b/hf_repo/hf_repo/hf_repo/agents/tools/storage.py
index 6d744d99a4ff2e9cd34e92fc40b9df538e807815..abc788acd749ff19c248fcdafda15c563860b24e 100644
--- a/hf_repo/hf_repo/hf_repo/agents/tools/storage.py
+++ b/hf_repo/hf_repo/hf_repo/agents/tools/storage.py
@@ -731,7 +731,7 @@ class Storage:
else:
# Личные сообщения + публичные от user/llm, которые не скрыты
query = """
- SELECT n.id, n.text, n.source, n.user_did, u.username, n.timestamp, n.hidden
+ SELECT n.id, n.text, n.source, n.user_did, u.username, u.badges, n.timestamp, n.hidden
FROM notes n
LEFT JOIN users u ON n.user_did = u.did
WHERE n.user_did = ?
diff --git a/hf_repo/hf_repo/hf_repo/hf_repo/agents/notebook/templates/messages.html b/hf_repo/hf_repo/hf_repo/hf_repo/agents/notebook/templates/messages.html
index cbe7f6e15dab23817549a40535595a73d52b60e6..8b6c076dad77c38f5846dd71252100836e2c4379 100644
--- a/hf_repo/hf_repo/hf_repo/hf_repo/agents/notebook/templates/messages.html
+++ b/hf_repo/hf_repo/hf_repo/hf_repo/agents/notebook/templates/messages.html
@@ -46,7 +46,7 @@
Источник: