Gazette: Removes uses of structure keyword in templates (#1402)

This also adds `MarkupText` as a new column type

TYPE: Bugfix
LINK: OGC-1715

.pre-commit-config.yaml

@@ -14,7 +14,7 @@ repos:
       - id: nocheckin
         exclude: .pre-commit-config.yaml
       - id: pt_structure
-        include: .*/(election_day|swissvotes|wtfs)/.*\.pt$
+        include: .*/(election_day|gazette|onboarding|swissvotes|wtfs)/.*\.pt$
   - repo: https://github.com/PyCQA/flake8
     rev: 7.0.0
     hooks:

src/onegov/core/orm/types/__init__.py

@@ -1,12 +1,14 @@
 from onegov.core.orm.types.hstore_type import HSTORE
 from onegov.core.orm.types.json_type import JSON
+from onegov.core.orm.types.markup_text_type import MarkupText
 from onegov.core.orm.types.utcdatetime_type import UTCDateTime
 from onegov.core.orm.types.uuid_type import UUID
 from onegov.core.orm.types.lowercase_text_type import LowercaseText
 
 __all__ = [
     'HSTORE',
     'JSON',
+    'MarkupText',
     'UTCDateTime',
     'UUID',
     'LowercaseText'

src/onegov/core/orm/types/lowercase_text_type.py

@@ -14,6 +14,8 @@ class LowercaseText(_Base):
     """ Text column that forces all text to be lowercase. """
 
     impl = TEXT
+    # FIXME: This was spelled incorrectly, but fixing the spelling
+    #        causes some issues with custom join conditions
     omparator_factory = CaseInsensitiveComparator
 
     def process_bind_param(

src/onegov/core/orm/types/markup_text_type.py

@@ -0,0 +1,48 @@
+from markupsafe import escape, Markup
+from sqlalchemy.types import TypeDecorator, TEXT
+
+
+from typing import TYPE_CHECKING
+if TYPE_CHECKING:
+    from sqlalchemy.engine.interfaces import Dialect
+    _Base = TypeDecorator[Markup]
+else:
+    _Base = TypeDecorator
+
+
+class MarkupText(_Base):
+    """ Text column that contains HTML/XML markup. """
+
+    impl = TEXT
+
+    cache_ok = True
+
+    def process_bind_param(
+        self,
+        value: str | None,
+        dialect: 'Dialect'
+    ) -> Markup | None:
+
+        return None if value is None else escape(value)
+
+    def process_literal_param(
+        self,
+        value: str | None,
+        dialect: 'Dialect'
+    ) -> Markup | None:
+
+        return None if value is None else escape(value)
+
+    def process_result_value(
+        self,
+        value: str | None,
+        dialect: 'Dialect'
+    ) -> Markup | None:
+
+        # NOTE: It would be safer to sanitize the text, in case someone
+        #       managed to bypass `process_bind_param` and inserted
+        #       unsanitized markup into the database. However, this would
+        #       also add a ton of static overhead. If we decide we want
+        #       the additional safety, we should use an approach like
+        #       OCQMS' lazy Sanitized text type.
+        return None if value is None else Markup(value)  # noqa: MS001

src/onegov/gazette/collections/notices.py

@@ -27,17 +27,16 @@
     from collections.abc import Iterable
     from collections.abc import Sized
     from onegov.gazette.request import GazetteRequest
+    from onegov.notice.collections import _StrColumnLike
     from onegov.notice.models import NoticeState
     from datetime import date
     from sqlalchemy.orm import Query
     from sqlalchemy.orm import Session
-    from sqlalchemy.sql import ColumnElement
     from typing import TypeVar
     from typing_extensions import Self
     from uuid import UUID
 
     _T = TypeVar('_T')
-    _StrColumnLike = ColumnElement[str] | ColumnElement[str | None]
 
 
 TRANSLATIONS: dict[str | None, str] = {

src/onegov/gazette/forms/notice.py

@@ -9,7 +9,7 @@
 from onegov.gazette.models import Category
 from onegov.gazette.models import Issue
 from onegov.gazette.models import Organization
-from onegov.quill import QuillField
+from onegov.quill.fields import QuillMarkupField
 from onegov.quill.validators import HtmlDataRequired
 from sedate import as_datetime
 from sedate import standardize_date
@@ -99,7 +99,7 @@ class NoticeForm(Form):
         ]
     )
 
-    text = QuillField(
+    text = QuillMarkupField(
         label=_("Text"),
         tags=('strong', 'ol', 'ul'),
         validators=[

src/onegov/gazette/layout.py

@@ -1,4 +1,5 @@
 from functools import cached_property
+from markupsafe import Markup
 from onegov.core.layout import ChameleonLayout
 from onegov.core.static import StaticFile
 from onegov.gazette import _
@@ -363,8 +364,7 @@ def format_issue(
             ))
 
     def format_text(self, text: str | None) -> str:
-        # FIXME: Markupsafe
-        return '<br>'.join((text or '').splitlines())
+        return Markup('<br>').join((text or '').splitlines())
 
 
 class MailLayout(Layout):

src/onegov/gazette/templates/layout.pt

@@ -67,7 +67,7 @@
         <div class="row">
           <div class="small-12 columns" id="alert-boxes">
             <div tal:repeat="message request.consume_messages()" data-alert class="alert-box ${message.type}">
-              <tal:block tal:content="structure message.text" />
+              <tal:block tal:content="message.text" />
               <a href="#" class="close">&times;</a>
             </div>
           </div>

src/onegov/gazette/templates/macros.pt

@@ -166,10 +166,10 @@
 </metal:deadline_callout>
 
 <metal:notice_text define-macro="notice_text" i18n:domain="onegov.gazette">
-    <tal:block tal:content="structure notice.text"></tal:block>
+    <tal:block tal:content="notice.text"></tal:block>
     <p tal:condition="notice.author_place and notice.author_date">
         ${notice.author_place}, ${layout.format_date(notice.author_date, 'date_long')}<br>
-        <tal:block tal:content="structure layout.format_text(notice.author_name)" />
+        <tal:block tal:content="layout.format_text(notice.author_name)" />
     </p>
 </metal:notice_text>
 

src/onegov/gazette/templates/mail_notice_rejected.pt

@@ -26,7 +26,7 @@
             <dd>${model.id}</dd>
 
             <dt i18n:translate>Text</dt>
-            <dd class="callout" tal:content="structure model.text"></dd>
+            <dd class="callout" tal:content="model.text"></dd>
 
             <dt i18n:translate>Comment</dt>
             <dd>${comment}</dd>

src/onegov/gazette/templates/mail_on_accept.pt

@@ -21,7 +21,7 @@
 
             <tal:block tal:condition="model.at_cost">
                 <dt i18n:translate>Billing address</dt>
-                <dd><tal:block tal:content="structure layout.format_text(model.billing_address)" /></dd>
+                <dd><tal:block tal:content="layout.format_text(model.billing_address)" /></dd>
             </tal:block>
 
             <dt tal:condition="model.files" i18n:translate>Attachments</dt>

src/onegov/gazette/templates/notice.pt

@@ -59,7 +59,7 @@
                             <dd tal:condition="not: notice.at_cost" i18n:translate>No</dd>
 
                             <dt tal:condition="notice.at_cost" i18n:translate>Billing address</dt>
-                            <dd tal:condition="notice.at_cost" tal:content="structure layout.format_text(notice.billing_address)"></dd>
+                            <dd tal:condition="notice.at_cost" tal:content="layout.format_text(notice.billing_address)"></dd>
 
                             <dt i18n:translate>User</dt>
                             <dd>
@@ -89,7 +89,7 @@
 
                 <tal:block tal:condition="publisher and notice.note">
                     <h3 i18n:translate>Note</h3>
-                    <p tal:content="structure layout.format_text(notice.note)"></p>
+                    <p tal:content="layout.format_text(notice.note)"></p>
                 </tal:block>
 
                 <h3 i18n:translate>Changes</h3>