django-smartbase-admin 2.3.7__tar.gz → 2.3.9__tar.gz

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-smartbase-admin
-Version: 2.3.7
+Version: 2.3.9
 Summary: 
 Home-page: https://smartbase-sk.github.io/django-smartbase-admin-docs/
 License: MIT
@@ -37,7 +37,7 @@ Requires-Dist: easy-thumbnails[svg] (>=2.8.5,<3.0.0)
 Requires-Dist: jsonschema (>=4.10,<5.0)
 Requires-Dist: lzstring (>=1.0.4,<2.0.0)
 Requires-Dist: mcp (>=1.8,<2) ; extra == "mcp"
-Requires-Dist: nh3 (>=0.2.15) ; extra == "mcp"
+Requires-Dist: nh3 (>=0.2.15)
 Requires-Dist: setuptools (>=67.0.0,<68.0.0)
 Requires-Dist: xlsxwriter (>=3.2.0,<4.0.0)
 Project-URL: Repository, https://github.com/SmartBase-SK/django-smartbase-admin

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.3.7"
+version = "2.3.9"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"
@@ -46,6 +46,8 @@ django-htmx = "^1.17.3"
 # JSON Schema validation server-side for SBAdminJsonEditorField
 jsonschema = "^4.10"
 lzstring = "^1.0.4"
+# HTML sanitization for rich-text submissions and MCP display values.
+nh3 = ">=0.2.15"
 # required for django-filer
 setuptools = "^67.0.0"
 # Optional MCP dependencies: only required when wiring the MCP toolset
@@ -60,8 +62,6 @@ django-mcp-server = {version = "^0.5.7", optional = true}
 # ``from mcp.server import FastMCP`` fails on a fresh install. Cap here
 # until upstream supports 2.x.
 mcp = {version = ">=1.8,<2", optional = true}
-# Allowlist HTML sanitizer for ``fetch_detail`` display values.
-nh3 = {version = ">=0.2.15", optional = true}
 
 [tool.poetry.extras]
 mcp = [
@@ -69,7 +69,6 @@ mcp = [
     "djangorestframework",
     "django-mcp-server",
     "mcp",
-    "nh3",
 ]
 
 [build-system]

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/admin/admin_base.py

@@ -159,10 +159,10 @@ from django_smartbase_admin.engine.admin_base_view import (
     SBAdminBaseListView,
     SBAdminBaseView,
     SBAdminBaseQuerysetMixin,
-    SBADMIN_IS_MODAL_VAR,
     SBADMIN_PARENT_INSTANCE_PK_VAR,
     SBADMIN_PARENT_INSTANCE_LABEL_VAR,
     SBADMIN_PARENT_INSTANCE_FIELD_NAME_VAR,
+    SBADMIN_PARENT_INSTANCE_MODEL_VAR,
     SBADMIN_RELOAD_ON_SAVE_VAR,
 )
 from django_smartbase_admin.engine.const import (
@@ -1249,10 +1249,13 @@ class SBAdmin(
             response,
             "sbadmin:modal-change-form-response",
             {
-                "field": request.POST.get("sb_admin_source_field"),
+                "field": cls.get_request_parameter(request, "sb_admin_source_field"),
                 "id": obj.pk,
                 "label": str(obj),
-                "reload": request.POST.get(SBADMIN_RELOAD_ON_SAVE_VAR) == "1",
+                "reload": (
+                    cls.get_request_parameter(request, SBADMIN_RELOAD_ON_SAVE_VAR)
+                    == "1"
+                ),
             },
         )
         trigger_client_event(response, "hideModal", {"elt": "sb-admin-modal"})
@@ -1299,15 +1302,18 @@ class SBAdmin(
     def set_generic_relation_from_parent(cls, request, obj):
         from django_smartbase_admin.admin.site import sb_admin_site
 
-        parent_path = request.POST.get(SBADMIN_PARENT_INSTANCE_FIELD_NAME_VAR)
-        parent_pk = request.POST.get(SBADMIN_PARENT_INSTANCE_PK_VAR)
-        if not (parent_path and parent_pk):
+        parent_field = cls.get_request_parameter(
+            request, SBADMIN_PARENT_INSTANCE_FIELD_NAME_VAR
+        )
+        parent_model_path = cls.get_request_parameter(
+            request, SBADMIN_PARENT_INSTANCE_MODEL_VAR
+        )
+        parent_pk = cls.get_request_parameter(request, SBADMIN_PARENT_INSTANCE_PK_VAR)
+        if not (parent_field and parent_model_path and parent_pk):
             return
 
-        # Token: ``modal_<app>_<model>_<field>_<parent_model>``; rsplit
-        # tolerates underscores in app labels / model names.
         try:
-            _, _, app_label, model_name = parent_path.rsplit("_", 3)
+            app_label, model_name = parent_model_path.split(".", 1)
             content_type = ContentType.objects.get(
                 app_label=app_label, model=model_name
             )
@@ -1329,7 +1335,7 @@ class SBAdmin(
         obj.object_id = int(parent_pk)
 
     def save_model(self, request, obj, form, change):
-        if self.sbadmin_is_generic_model and SBADMIN_IS_MODAL_VAR in request.POST:
+        if self.sbadmin_is_generic_model and is_modal(request):
             self.set_generic_relation_from_parent(request, obj)
         super().save_model(request, obj, form, change)
 
@@ -1525,14 +1531,20 @@ class SBAdminInline(
             "add_url": add_url,
         }
         if self.parent_instance:
+            parent_field_name = "{}_{}_id_{}".format(
+                self.model._meta.app_label,
+                self.model._meta.model_name,
+                self.parent_model._meta.model_name,
+            )
+            parent_model_path = "{}.{}".format(
+                self.parent_model._meta.app_label,
+                self.parent_model._meta.model_name,
+            )
             context_data["parent_data"] = {
                 SBADMIN_PARENT_INSTANCE_PK_VAR: self.parent_instance.pk,
                 SBADMIN_PARENT_INSTANCE_LABEL_VAR: str(self.parent_instance),
-                SBADMIN_PARENT_INSTANCE_FIELD_NAME_VAR: "{}_{}_id_{}".format(
-                    self.model._meta.app_label,
-                    self.model._meta.model_name,
-                    self.parent_model._meta.model_name,
-                ),
+                SBADMIN_PARENT_INSTANCE_FIELD_NAME_VAR: parent_field_name,
+                SBADMIN_PARENT_INSTANCE_MODEL_VAR: parent_model_path,
             }
         return context_data
 

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/admin/widgets.py

@@ -1,6 +1,8 @@
 import json
 import sys
+from html.parser import HTMLParser
 
+import nh3
 from ckeditor.widgets import CKEditorWidget
 from ckeditor_uploader.widgets import CKEditorUploadingWidget
 from django import forms
@@ -328,6 +330,249 @@ class SBAdminTextareaWidget(SBAdminBaseWidget, forms.Textarea):
         super().__init__(form_field, attrs={"class": "input", **(attrs or {})})
 
 
+def _parse_richtext_image_id(value):
+    if not value or not value.isascii() or not value.isdigit() or value.startswith("0"):
+        return None
+    try:
+        return int(value)
+    except ValueError:
+        return None
+
+
+class _RichTextImageIdParser(HTMLParser):
+    def __init__(self):
+        super().__init__(convert_charrefs=True)
+        self.image_ids = []
+
+    def handle_starttag(self, tag, attrs):
+        if tag.casefold() != "img":
+            return
+        image_id = _parse_richtext_image_id(dict(attrs).get("data-filer-image-id"))
+        if image_id is not None:
+            self.image_ids.append(image_id)
+
+
+_RICH_TEXT_ALLOWED_ATTRIBUTES = {
+    tag: set(attributes) for tag, attributes in nh3.ALLOWED_ATTRIBUTES.items()
+}
+_RICH_TEXT_ALLOWED_ATTRIBUTES["*"] = {"style"}
+_RICH_TEXT_ALLOWED_ATTRIBUTES.setdefault("img", set()).update(
+    {"data-filer-image-id", "loading", "title"}
+)
+_RICH_TEXT_ALLOWED_ATTRIBUTES.setdefault("td", set()).add("colwidth")
+_RICH_TEXT_ALLOWED_ATTRIBUTES.setdefault("th", set()).add("colwidth")
+
+
+def _sanitize_rich_text(value):
+    """Sanitize submitted HTML while preserving the attributes Tiptap emits.
+
+    The nh3 defaults provide the security allowlist, but omit ``style``, filer image
+    IDs, image metadata, and table ``colwidth``. Those attributes are added above,
+    with CSS still restricted to the three properties supported by this editor.
+    ``link_rel`` is disabled because Tiptap does not emit ``rel`` without ``target``.
+    """
+    if value is None or value == "":
+        return value
+    return nh3.clean(
+        str(value),
+        tags=nh3.ALLOWED_TAGS,
+        attributes=_RICH_TEXT_ALLOWED_ATTRIBUTES,
+        filter_style_properties={"color", "text-align", "width"},
+        link_rel=None,
+    )
+
+
+class SBAdminRichTextWidget(SBAdminTextareaWidget):
+    template_name = "sb_admin/widgets/richtext.html"
+    button_template = "sb_admin/widgets/includes/richtext/action_button.html"
+    toolbar_actions = (
+        {
+            "name": "block",
+            "template": "sb_admin/widgets/includes/richtext/block.html",
+        },
+        {"name": "bold", "label": _("Bold"), "icon": "Text-bold"},
+        {"name": "italic", "label": _("Italic"), "icon": "Text-italic"},
+        {
+            "name": "underline",
+            "label": _("Underline"),
+            "icon": "Text-underline",
+        },
+        {
+            "name": "color",
+            "label": _("Text color"),
+            "template": "sb_admin/widgets/includes/richtext/color.html",
+        },
+        {
+            "name": "align-left",
+            "label": _("Align left"),
+            "icon": "Align-text-left",
+        },
+        {
+            "name": "align-center",
+            "label": _("Align center"),
+            "icon": "Align-text-center",
+        },
+        {
+            "name": "align-right",
+            "label": _("Align right"),
+            "icon": "Align-text-right",
+        },
+        {
+            "name": "align-justify",
+            "label": _("Justify"),
+            "icon": "Align-text-both",
+        },
+        {
+            "name": "link",
+            "label": _("Link"),
+            "icon": "Link",
+            "dialog_template": "sb_admin/widgets/includes/richtext/link_dialog.html",
+        },
+        {
+            "name": "image",
+            "label": _("Image"),
+            "icon": "Add-picture",
+            "template": "sb_admin/widgets/includes/richtext/image.html",
+        },
+        {
+            "name": "table",
+            "label": _("Insert table"),
+            "icon": "Insert-table",
+        },
+        {
+            "name": "bullet-list",
+            "label": _("Bulleted list"),
+            "icon": "List-two",
+        },
+        {
+            "name": "ordered-list",
+            "label": _("Numbered list"),
+            "icon": "List-numbers",
+        },
+        {"name": "outdent", "label": _("Outdent"), "icon": "Indent-left"},
+        {"name": "indent", "label": _("Indent"), "icon": "Indent-right"},
+        {
+            "name": "clear",
+            "label": _("Clear formatting"),
+            "icon": "Clear-format",
+        },
+        {"name": "source", "label": _("HTML source"), "icon": "Code"},
+        {
+            "name": "table-menu",
+            "label": _("Table options"),
+            "requires": "table",
+            "template": "sb_admin/widgets/includes/richtext/table_menu.html",
+        },
+    )
+
+    class Media:
+        extend = False
+        js = [
+            "sb_admin/dist/media_picker.js",
+            "sb_admin/dist/richtext.js",
+        ]
+
+    def __init__(
+        self,
+        form_field=None,
+        attrs=None,
+        *,
+        is_public=True,
+        disabled_actions=(),
+    ):
+        self.form = None
+        self.field_name = None
+        self.view = None
+        self.request = None
+        self.is_public = is_public
+        self.disabled_actions = tuple(disabled_actions)
+        attrs = attrs or {}
+        super().__init__(
+            form_field=form_field,
+            attrs={
+                "class": (
+                    f"input sbadmin-richtext__source hidden "
+                    f"{attrs.get('class') or ''}"
+                ).strip(),
+                "rows": 8,
+                **{key: value for key, value in attrs.items() if key != "class"},
+            },
+        )
+
+    def init_widget_dynamic(self, form, form_field, field_name, view, request):
+        super().init_widget_dynamic(form, form_field, field_name, view, request)
+        self.form = form
+        self.field_name = field_name
+        self.view = view
+        self.request = request
+
+    def get_request(self):
+        return self.request or SBAdminThreadLocalService.get_request()
+
+    def value_from_datadict(self, data, files, name):
+        return _sanitize_rich_text(super().value_from_datadict(data, files, name))
+
+    @staticmethod
+    def image_ids(value):
+        parser = _RichTextImageIdParser()
+        parser.feed(str(value or ""))
+        parser.close()
+        return tuple(dict.fromkeys(parser.image_ids))
+
+    def image_items(self, value):
+        image_ids = self.image_ids(value)
+        request = self.get_request()
+        if not image_ids or request is None or not hasattr(request, "request_data"):
+            return {}
+        queryset = FilerMediaPickerService.accessible_item_queryset(
+            request,
+            MEDIA_PICKER_TYPE_IMAGE,
+        ).filter(pk__in=image_ids)
+        if self.is_public is not None:
+            queryset = queryset.filter(is_public=self.is_public)
+        return {
+            str(image.pk): {
+                "label": item["name"],
+                "thumbnail_url": item["thumbnail_url"],
+                "original_url": item["original_url"],
+            }
+            for image in queryset
+            for item in (FilerMediaPickerService.item_data(image),)
+        }
+
+    def get_toolbar_actions(self):
+        disabled_actions = set(self.disabled_actions)
+        actions = []
+        for definition in self.toolbar_actions:
+            if definition["name"] in disabled_actions:
+                continue
+            if definition.get("requires") in disabled_actions:
+                continue
+            action = {"template": self.button_template, **definition}
+            if action["name"] == "image":
+                action["media_picker_url"] = (
+                    f"{reverse('sb_admin:media_picker')}?picker_type=image"
+                    f"&is_public={str(self.is_public).lower()}"
+                )
+            actions.append(action)
+        return tuple(actions)
+
+    def get_context(self, name, value, attrs):
+        context = super().get_context(name, value, attrs)
+        widget = context["widget"]
+        widget["items"] = self.image_items(value)
+        widget["is_readonly"] = bool(
+            widget["attrs"].get("readonly") or widget["attrs"].get("disabled")
+        )
+        # The textarea is hidden behind Tiptap, so native required validation cannot
+        # focus it. Django remains responsible for required-field validation and the
+        # surrounding form templates render the resulting bound-field errors.
+        widget["attrs"].pop("required", None)
+        widget["disabled_actions"] = self.disabled_actions
+        widget["toolbar_actions"] = self.get_toolbar_actions()
+        return context
+
+
 class SBAdminEmailInputWidget(
     SBAdminInputAffixMixin, SBAdminBaseWidget, forms.EmailInput
 ):

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/audit/manager.py

@@ -9,6 +9,7 @@ from contextlib import contextmanager
 from dataclasses import dataclass
 
 from django.db import transaction
+from django.utils.encoding import force_str
 from django_smartbase_admin.audit.utils.diff import (
     compute_bulk_diff,
     compute_bulk_snapshot,
@@ -206,15 +207,6 @@ def _extract_fk_affected(model, changes: dict) -> list[dict]:
     return affected
 
 
-def _get_object_repr(model, pk) -> str:
-    """Try to get object repr, fallback to ID."""
-    try:
-        obj = model._default_manager.get(pk=pk)
-        return str(obj)
-    except Exception:
-        return f"#{pk}"
-
-
 def _get_request_id() -> uuid.UUID | None:
     """
     Get or create a request_id to group changes from the same request.
@@ -239,10 +231,21 @@ def _get_request_id() -> uuid.UUID | None:
         return None
 
 
+def _safe_str(obj, limit: int = 255) -> str:
+    """Return a bounded string even if ``__str__`` returns a lazy proxy."""
+    try:
+        return force_str(type(obj).__str__(obj))[:limit]
+    except Exception:
+        try:
+            return f"{obj._meta.verbose_name} #{obj.pk}"
+        except Exception:
+            return ""
+
+
 def _get_object_repr(model, object_id) -> str:
     try:
         obj = model._default_manager.get(pk=object_id)
-        return str(obj)[:255]
+        return _safe_str(obj)
     except Exception:
         return f"{model.__name__} #{object_id}"
 
@@ -488,7 +491,7 @@ def audited_qs_update(self, **kwargs):
                         action_type="update",
                         model=model,
                         object_id=str(pk),
-                        object_repr=str(obj),
+                        object_repr=_safe_str(obj),
                         snapshot_before=before,
                         changes=changes,
                     )
@@ -534,7 +537,7 @@ def audited_qs_delete(self):
             for obj in self.all():
                 pks.append(str(obj.pk))
                 data = serialize_instance(obj)
-                data["__repr__"] = str(obj)[:255]
+                data["__repr__"] = _safe_str(obj)
                 objects_before.append(data)
     except Exception:
         logger.debug(
@@ -745,7 +748,7 @@ def audited_model_save(self, *args, **kwargs):
                     action_type="create",
                     model=model,
                     object_id=str(self.pk),
-                    object_repr=str(self),
+                    object_repr=_safe_str(self),
                     snapshot_before={},
                     changes=changes,
                 )
@@ -758,7 +761,7 @@ def audited_model_save(self, *args, **kwargs):
                     action_type="update",
                     model=model,
                     object_id=str(self.pk),
-                    object_repr=str(self),
+                    object_repr=_safe_str(self),
                     snapshot_before=before,
                     changes=changes,
                 )
@@ -782,7 +785,7 @@ def audited_model_delete(self, *args, **kwargs):
     try:
         with transaction.atomic():
             before = serialize_instance(self)
-            obj_repr = str(self)[:255]
+            obj_repr = _safe_str(self)
     except Exception:
         logger.debug(
             "Audit: Could not capture object before delete for %s",

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/audit/tests/test_audit_integration.py

@@ -10,6 +10,7 @@ from django.contrib.admin.sites import AdminSite
 from django.contrib.auth.models import Group, Permission, User
 from django.contrib.contenttypes.models import ContentType
 from django.test import RequestFactory, TransactionTestCase
+from django.utils.translation import gettext_lazy as _
 from django_smartbase_admin.audit.manager import (
     AuditParentContext,
     audit_parent_context,
@@ -215,6 +216,17 @@ class TestAdminCRUD(BaseAuditTest):
         self.assertEqual(log.snapshot_before, {})
         self.assertIsNotNone(log.request_id)
 
+    def test_create_logs_object_repr_when_str_returns_lazy_proxy(self):
+        group = Group(name=_("New device"))
+
+        with MockSBAdminContext(user=self.admin_user):
+            self.admin.save_model(self.request, group, form=None, change=False)
+
+        log = AdminAuditLog.objects.get(
+            content_type=self.group_ct, action_type="create"
+        )
+        self.assertEqual(log.object_repr, "New device")
+
     def test_update_logs_old_and_new_values(self):
         with NoAdminContext():
             group = Group.objects.create(name="Original")

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/engine/admin_base_view.py

@@ -69,6 +69,7 @@ if TYPE_CHECKING:
 
 SBADMIN_IS_MODAL_VAR = "sbadmin_is_modal"
 SBADMIN_PARENT_INSTANCE_FIELD_NAME_VAR = "sbadmin_parent_instance_field"
+SBADMIN_PARENT_INSTANCE_MODEL_VAR = "sbadmin_parent_instance_model"
 SBADMIN_PARENT_INSTANCE_PK_VAR = "sbadmin_parent_instance_pk"
 SBADMIN_PARENT_INSTANCE_LABEL_VAR = "sbadmin_parent_instance_label"
 SBADMIN_RELOAD_ON_SAVE_VAR = "sbadmin_reload_on_save"
@@ -84,6 +85,11 @@ class SBAdminBaseView(object):
     widgets = None
     widget_views = None
 
+    @staticmethod
+    def get_request_parameter(request, name: str, default=None):
+        """Read routing state from GET, with POST fallback for compatibility."""
+        return request.GET.get(name, request.POST.get(name, default))
+
     def init_view_static(self, configuration, model, admin_site):
         self.admin_site = admin_site
         self.init_widgets_static(configuration)

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/locale/sk/LC_MESSAGES/django.po

@@ -493,7 +493,7 @@ msgid "Save"
 msgstr "Uložiť"
 
 msgid "Close"
-msgstr "Zatvoriť"
+msgstr "Zavrieť"
 
 msgid "Prev"
 msgstr "Pred."

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/services/media_picker.py

@@ -374,6 +374,7 @@ class FilerMediaPickerService:
     @classmethod
     def item_data(cls, item: Any) -> dict[str, Any]:
         model_name = item._meta.model_name
+        file = getattr(item, "file", None)
         thumbnail_url = reverse(
             f"sb_admin:filer_{model_name}_fileicon",
             kwargs={
@@ -385,6 +386,7 @@ class FilerMediaPickerService:
             "id": item.pk,
             "name": item.label,
             "thumbnail_url": thumbnail_url,
+            "original_url": file.url if file else "",
             "change_url": cls.change_url(item),
             "size": item._file_size,
             "uploaded_at": item.uploaded_at,

{django_smartbase_admin-2.3.7 → django_smartbase_admin-2.3.9}/src/django_smartbase_admin/static/sb_admin/build/webpack.common.js

@@ -16,6 +16,7 @@ const entries = {
     tree_widget: './src/django_smartbase_admin/static/sb_admin/src/js/tree_widget.js',
     tree_widget_style: './src/django_smartbase_admin/static/sb_admin/src/css/tree_widget.css',
     media_picker: './src/django_smartbase_admin/static/sb_admin/src/js/media_picker.js',
+    richtext: './src/django_smartbase_admin/static/sb_admin/src/js/richtext.js',
     calendar_style: './src/django_smartbase_admin/static/sb_admin/src/css/calendar.css',
     modal_view: './src/django_smartbase_admin/static/sb_admin/src/js/modal_view.js',
     sbadmin_formset: './src/django_smartbase_admin/static/sb_admin/src/js/sbadmin_formset.js',