fix: remove |safe from striptags output in search templates

apps/downloads/search_indexes.py

@@ -1,6 +1,7 @@
 """Haystack search indexes for the downloads app."""
 
 import datetime
+import html
 
 from django.template.defaultfilters import striptags, truncatewords_html
 from django.utils import timezone
@@ -43,7 +44,7 @@ def prepare_version(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text description."""
-        return striptags(truncatewords_html(obj.content.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.content.rendered, 50)))
 
     def prepare(self, obj):
         """Boost recent releases."""

apps/events/search_indexes.py

@@ -1,5 +1,7 @@
 """Haystack search indexes for the events app."""
 
+import html
+
 from django.template.defaultfilters import striptags, truncatewords_html
 from haystack import indexes
 
@@ -28,7 +30,7 @@ def prepare_path(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text description."""
-        return striptags(truncatewords_html(obj.description, 50))
+        return html.unescape(striptags(truncatewords_html(obj.description, 50)))
 
     def prepare_include_template(self, obj):
         """Return the search result template path."""
@@ -65,7 +67,7 @@ def prepare_path(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text description."""
-        return striptags(truncatewords_html(obj.description.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.description.rendered, 50)))
 
     def prepare_venue(self, obj):
         """Return the venue name or None if no venue is set."""

apps/jobs/search_indexes.py

@@ -1,5 +1,7 @@
 """Haystack search indexes for the jobs app."""
 
+import html
+
 from django.template.defaultfilters import striptags, truncatewords_html
 from django.urls import reverse
 from haystack import indexes
@@ -101,7 +103,7 @@ def prepare_include_template(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text job description."""
-        return striptags(truncatewords_html(obj.description.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.description.rendered, 50)))
 
     def prepare_path(self, obj):
         """Return the URL for this job listing."""

apps/pages/search_indexes.py

@@ -1,5 +1,7 @@
 """Haystack search indexes for the pages app."""
 
+import html
+
 from django.template.defaultfilters import striptags, truncatewords_html
 from haystack import indexes
 
@@ -27,7 +29,7 @@ def prepare_description(self, obj):
         """Create a description if none exists."""
         if obj.description:
             return obj.description
-        return striptags(truncatewords_html(obj.content.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.content.rendered, 50)))
 
     def index_queryset(self, using=None):
         """Only index published pages."""

templates/search/includes/downloads.release.html

@@ -1,7 +1,7 @@
 <h3>Release &ndash; <a href="{{ result.path }}">{{ result.name }}</a></h3>
 <p>Version: {{ result.version }}</p>
 <p>Released: {{ result.release_date|date }}</p>
-<p>{{ result.description|safe }}</p>
+<p>{{ result.description }}</p>
 {% if result.release_notes_url %}
 <p><a href="{{ result.release_notes_url }}">View Release Notes</a></p>
 {% endif %}

templates/search/includes/events.calendar.html

@@ -1,5 +1,5 @@
 <h3>Calendar &ndash; <a href="/{{ result.path }}">{{ result.name }}</a></h3>
-<p>{{ result.description|safe }}</p>
+<p>{{ result.description }}</p>
 {% if result.rss %}
 <p><a href="{{ result.rss }}">RSS Feed</a></p>
 {% endif %}

templates/search/includes/events.event.html

@@ -25,4 +25,4 @@ <h3>Event &ndash; <a href="{{ result.path }}">{{ result.name }}</a></h3>
 <p>Location: {{ result.venue }}</p>
 {% endif %}
 
-<p>{{ result.description|safe }}</p>
+<p>{{ result.description }}</p>

templates/search/includes/jobs.job.html

@@ -3,4 +3,4 @@ <h3><a href="{{ result.path }}">Job - {{ result.name }}</a></h3>
 <p>Location: {{ result.city }}{% if result.region %}, {{ result.region }}{% endif %} {{ result.country }}</p>
 
 {% if result.telecommuting %}<p>Telecommuting: Yes</p>{% endif %}
-<p>{{ result.description|safe }}</p>
+<p>{{ result.description }}</p>