consistent markdown behaviour by dropping backend markdown render in favor of javascript markdown rendering (#221) (#544)

peeringdb_server/static/peeringdb.js

@@ -87,6 +87,16 @@ PeeringDB = {
        });
     });
 
+    // render markdown content
+    $('[data-render-markdown="yes"]').each(function() {
+      var converter = new showdown.Converter()
+      var value = $(this).data("edit-value")
+      // sanitize any html tags
+      var html = converter.makeHtml(value.replace(/>/g, '&gt;').replace(/</g, '&lt;'))
+      // set html after further sanitizing output via DOMPurify
+      $(this).html(DOMPurify.sanitize(html, {SAFE_FOR_JQUERY: true}))
+    })
+
   },
 
   // fix list x offsets depending on whether content is overflowing
@@ -1157,6 +1167,7 @@ twentyc.editable.module.register(
 twentyc.editable.input.register(
   "markdown",
   {
+
     apply : function(value) {
       var converter = new showdown.Converter()
       if(!value)

peeringdb_server/templates/site/view.html

@@ -126,6 +126,7 @@
           </div>
         {% elif row.type == "fmt-text" %}
           <div class="view_value col-xs-8 col-sm-7 col-md-8 fmt_text"
+               data-render-markdown="yes"
                {% if not row.readonly and permissions.can_write %}
                data-edit-type="markdown"
                {% endif %}
@@ -134,7 +135,7 @@
                {% endif %}
                data-edit-value="{{ row.value }}"
                data-edit-name="{{ row.name }}">
-                    {{ row.value|render_markdown|safe }}
+                    {{ row.value }}
                     {% if row.name == "notes" and row.value and request.user.is_authenticated %}
                         <div>
                             <!-- select name="language-from">