Village long description #1863

ashirley · 2025-10-20T12:40:53Z

There is still a lot to tidy up here but wanted to get some opinions sooner rather than later about iFrame layout options

Add a long_description field to villages. This is markdown from untrusted users and is rendered using nh3 and a sandboxed iFrame in order to limit the untrusted HTML.

There are 2 layout options for the iFrame:

The first uses javascript to resize the iFrame to prevent scrolling within the iFrame.

The second uses a static size for the iFrame which scrolls for long content.

The advantage of the second is that we can remove the allow-scripts privilege from the iFrame.

fixes #1816

wlcx · 2025-10-20T13:47:14Z

unexpected status from HEAD request to https://registry-1.docker.io/v2/library/node/manifests/12-alpine: 500 Internal Server Error

us-east-1 detected

wlcx

I know this is partially a draft PR, sorry if you already had any of these on your list!

Looks like the migration needs "rebasing" onto the newest HEAD migration.
My humble request would be for new code to have type annotations. Very happy to help if there's any mypy gnarliness.
From a UX perspective I think we should state the markdown limitations (i.e. images disabled) in the form.

I'll leave the security considerations to someone with more experience in that area 😅

wlcx · 2025-10-20T14:27:30Z

templates/villages/view2.html

+<a href="{{ village.map_link }}">📍&nbsp;Map</a>
+{% endif %}
+
+{# TODO: Can we show what's on at the village venues here? #}


I was going to say that I'm not sure whether there's a link between Venue and Village, but on closer look Venue has a village_id field :)

@SamLR is this planned to still be the case?

lukegb · 2026-01-26T22:40:10Z

apps/villages/views.py

+        tags=(nh3.ALLOWED_TAGS - {"img"}),
+        link_rel="noopener nofollow",  # default includes noreferrer but not nofollow
+    )
+    innerHtml = render_template("sandboxed-iframe.html", body=Markup(contentHtml))


probably inner_html to keep with the snake-case standard?

lukegb · 2026-01-26T22:41:29Z

apps/villages/views.py

+        link_rel="noopener nofollow",  # default includes noreferrer but not nofollow
+    )
+    innerHtml = render_template("sandboxed-iframe.html", body=Markup(contentHtml))
+    iFrameHtml = f'<iframe sandbox="allow-scripts" class="embedded-content" srcdoc="{html.escape(innerHtml, True)}" onload="javascript:window.listenForFrameResizedMessages(this);"></iframe>'


The javascript: prefix here is unnecessary. It technically works, but I suspect that's only because it's treated as a label of javascript.

lukegb · 2026-01-26T22:46:34Z

apps/villages/views.py

+        link_rel="noopener nofollow",  # default includes noreferrer but not nofollow
+    )
+    innerHtml = render_template("sandboxed-iframe.html", body=Markup(contentHtml))
+    iFrameHtml = f'<iframe sandbox="allow-scripts" class="embedded-content" srcdoc="{html.escape(innerHtml, True)}" onload="javascript:window.listenForFrameResizedMessages(this);"></iframe>'


I don't really like having onload here; is it possible to move attaching the message handler elsewhere?

There are a few things which are a bit weird about doing this in onload anyway:

The attached handler is on window anyway, so it can be attached at ~any time.

What happens if there's more than one of these iframes on the page?

You'll probably need to do some iterating over the available iframe.embedded-contents to find the one where the contentWindow matches the event.source, but it'll make it more robust, I think.

lukegb · 2026-01-26T22:47:01Z

css/main.scss

    url("../static/fonts/raleway-v22-latin-ext_latin-700.woff2") format("woff2"),
    url("../static/fonts/raleway-v22-latin-ext_latin-700.woff") format("woff");
-}
+}


nit: please leave the ending newline in.

/me glares at the .editorconfig

lukegb · 2026-01-26T22:47:16Z

js/sandboxed-iframe.js

+}
+
+window.listenForFrameResizedMessages = listenForFrameResizedMessages;
+window.sendFrameResizedMessage = sendFrameResizedMessage;


nit: trailing newline please

lukegb · 2026-01-26T22:48:16Z

js/sandboxed-iframe.js

+        // Do we trust the sender of this message?
+        // origin of sandboxed iframes is null but is this a useful check?
+        // if (evt.origin !== null) {
+        //     return;
+        // }


Yeah, I think we just ignore the origin here anyway - in any case, as per the other comment we probably want to check on evt.source.

lukegb · 2026-01-26T22:54:47Z

templates/sandboxed-iframe.html

+        {% endblock -%}
+        {% block head -%}{% endblock -%}
+    </head>
+<body itemscope itemtype="http://schema.org/WebPage" {% block body_class %}{% endblock %} onload="javascript:window.sendFrameResizedMessage()" style="overflow: hidden;">


We probably want some other mechanism here (other than onload). Possibly split the resize JS into two (one for the parent, one for the child)?

lukegb · 2026-01-26T22:56:24Z

js/sandboxed-iframe.js

+}
+
+window.listenForFrameResizedMessages = listenForFrameResizedMessages;
+window.sendFrameResizedMessage = sendFrameResizedMessage;


You might also want to bind a ResizeObserver to the body so that we can catch change in the width of the iframe or similar - I don't actually recall if the iframe size will change much if e.g. the user is on desktop and resizes the window.

ashirley mentioned this pull request Oct 20, 2025

Village details page #1816

Open

wlcx requested changes Oct 20, 2025

View reviewed changes

ashirley force-pushed the village-long-description branch 2 times, most recently from 8b17a7b to 3ad70e8 Compare December 9, 2025 22:46

marksteward mentioned this pull request Jan 3, 2026

Village registration system #667

Open

8 tasks

ashirley added 9 commits January 26, 2026 21:21

use https instead of ssh as ssh isn't on the dev container

f51feb3

Add a view page for an individual village

362ee57

Add a long description and a couple of ways of rendering

2ef44b9

Rebase migration

fdef7e0

Add more type annotations and fix 2 None issues

4930ec4

Add test for rendering and tweak link's rel

a16d97f

Include help text in form

bb2be5b

integrate village view and edit pages better

2a1227f

render small descriptions better

911877f

ashirley force-pushed the village-long-description branch from df508ac to 911877f Compare January 26, 2026 21:24

Link to your village from list page if you have one

955379d

lukegb reviewed Jan 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Village long description #1863

Village long description #1863

Uh oh!

ashirley commented Oct 20, 2025 •

edited

Loading

Uh oh!

wlcx commented Oct 20, 2025

Uh oh!

wlcx left a comment

Uh oh!

wlcx Oct 20, 2025

Uh oh!

lukegb Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

edwinbalani Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

lukegb Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Village long description #1863

Are you sure you want to change the base?

Village long description #1863

Uh oh!

Conversation

ashirley commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wlcx commented Oct 20, 2025

Uh oh!

wlcx left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ashirley commented Oct 20, 2025 •

edited

Loading