```
+
+````
+```
+var s = "Code block";
+alert(s);
+```
+````
+
+```
+var s = "Code block";
+alert(s);
+```
+
+
+
+## Tables
+
+```no-highlight
+Colons can be used to align columns.
+
+| Tables | Are | Cool |
+| ------------- |:-------------:| -----:|
+| col 3 is | right-aligned | $1600 |
+| col 2 is | centered | $12 |
+| zebra stripes | are neat | $1 |
+
+There must be at least 3 dashes separating each header cell.
+The outer pipes (|) are optional, and you don't need to make the
+raw Markdown line up prettily. You can also use inline Markdown.
+
+Markdown | Less | Pretty
+--- | --- | ---
+*Still* | `renders` | **nicely**
+1 | 2 | 3
+```
+
+Colons can be used to align columns.
+
+| Tables | Are | Cool |
+| ------------- |:-------------:| -----:|
+| col 3 is | right-aligned | $1600 |
+| col 2 is | centered | $12 |
+| zebra stripes | are neat | $1 |
+
+There must be at least 3 dashes separating each header cell. The outer pipes (|) are optional, and you don't need to make the raw Markdown line up prettily. You can also use inline Markdown.
+
+Markdown | Less | Pretty
+--- | --- | ---
+*Still* | `renders` | **nicely**
+1 | 2 | 3
+
+
+
+## Blockquotes
+
+```no-highlight
+> Blockquotes are very handy in email to emulate reply text.
+> This line is part of the same quote.
+
+Quote break.
+
+> This is a very long line that will still be quoted properly when it wraps. Oh boy let's keep writing to make sure this is long enough to actually wrap for everyone. Oh, you can *put* **Markdown** into a blockquote.
+```
+
+> Blockquotes are very handy in email to emulate reply text.
+> This line is part of the same quote.
+
+Quote break.
+
+> This is a very long line that will still be quoted properly when it wraps. Oh boy let's keep writing to make sure this is long enough to actually wrap for everyone. Oh, you can *put* **Markdown** into a blockquote.
+
+
+
+## Inline HTML
+
+You can also use raw HTML in your Markdown, and it'll mostly work pretty well.
+
+```no-highlight
+-
+
- Definition list +
- Is something people use sometimes. + +
- Markdown in HTML +
- Does *not* work **very** well. Use HTML tags. +
-
+
- Definition list +
- Is something people use sometimes. + +
- Markdown in HTML +
- Does *not* work **very** well. Use HTML tags. +
Site time: {% timezone object.time_zone %}{% annotated_now %}{% endtimezone %} {% else %} - — + {{ ''|placeholder }} {% endif %} @@ -94,7 +94,7 @@ {{ object.physical_address|linebreaksbr }} {% else %} - — + {{ ''|placeholder }} {% endif %} @@ -113,7 +113,7 @@ {{ object.latitude }}, {{ object.longitude }} {% else %} - — + {{ ''|placeholder }} {% endif %} diff --git a/netbox/templates/dcim/virtualchassis_edit.html b/netbox/templates/dcim/virtualchassis_edit.html index 327f20531..275391c61 100644 --- a/netbox/templates/dcim/virtualchassis_edit.html +++ b/netbox/templates/dcim/virtualchassis_edit.html @@ -57,7 +57,7 @@ {% if device.rack %} {{ device.rack }} / {{ device.position }} {% else %} - — + {{ ''|placeholder }} {% endif %}
{{ object.validation_regex }}
{% else %}
- —
+ {{ ''|placeholder }}
{% endif %}
diff --git a/netbox/templates/extras/htmx/report_result.html b/netbox/templates/extras/htmx/report_result.html
index 9b3e9db5f..c20bf5fe2 100644
--- a/netbox/templates/extras/htmx/report_result.html
+++ b/netbox/templates/extras/htmx/report_result.html
@@ -57,7 +57,7 @@
{% elif obj %}
{{ obj }}
{% else %}
- —
+ {{ ''|placeholder }}
{% endif %}
{{ field.to_field_name }}
{% else %}
- —
+ {{ ''|placeholder }}
{% endif %}
{% empty %} - None + {{ ''|placeholder }} {% endfor %} diff --git a/netbox/templates/ipam/vlan.html b/netbox/templates/ipam/vlan.html index f74149ad6..fd0ba36a3 100644 --- a/netbox/templates/ipam/vlan.html +++ b/netbox/templates/ipam/vlan.html @@ -21,7 +21,7 @@ {% endif %} {{ object.site|linkify }} {% else %} - None + {{ ''|placeholder }} {% endif %} @@ -56,7 +56,7 @@ {% if object.role %} {{ object.role }} {% else %} - None + {{ ''|placeholder }} {% endif %} diff --git a/netbox/templates/tenancy/contact.html b/netbox/templates/tenancy/contact.html index f55e87895..8e71628e9 100644 --- a/netbox/templates/tenancy/contact.html +++ b/netbox/templates/tenancy/contact.html @@ -35,7 +35,7 @@ {% if object.phone %} {{ object.phone }} {% else %} - None + {{ ''|placeholder }} {% endif %} @@ -45,7 +45,7 @@ {% if object.email %} {{ object.email }} {% else %} - None + {{ ''|placeholder }} {% endif %} diff --git a/netbox/templates/tenancy/tenant.html b/netbox/templates/tenancy/tenant.html index e4c1db006..52c13e1aa 100644 --- a/netbox/templates/tenancy/tenant.html +++ b/netbox/templates/tenancy/tenant.html @@ -77,6 +77,10 @@
{{ stats.prefix_count }}
Prefixes
+
+
{{ stats.iprange_count }}
+IP Ranges
+{{ stats.ipaddress_count }}
IP addresses
diff --git a/netbox/templates/users/profile.html b/netbox/templates/users/profile.html index 112603126..913784c94 100644 --- a/netbox/templates/users/profile.html +++ b/netbox/templates/users/profile.html @@ -21,7 +21,7 @@ {% if request.user.first_name or request.user.last_name %} {{ request.user.first_name }} {{ request.user.last_name }} {% else %} - — + {{ ''|placeholder }} {% endif %} diff --git a/netbox/templates/virtualization/virtualmachine.html b/netbox/templates/virtualization/virtualmachine.html index 0dec4968c..61f9aa61a 100644 --- a/netbox/templates/virtualization/virtualmachine.html +++ b/netbox/templates/virtualization/virtualmachine.html @@ -49,7 +49,7 @@ (NAT: {{ object.primary_ip4.nat_outside.address.ip }}) {% endif %} {% else %} - — + {{ ''|placeholder }} {% endif %} @@ -64,7 +64,7 @@ (NAT: {{ object.primary_ip6.nat_outside.address.ip }}) {% endif %} {% else %} - — + {{ ''|placeholder }} {% endif %} @@ -115,7 +115,7 @@ {% if object.memory %} {{ object.memory|humanize_megabytes }} {% else %} - — + {{ ''|placeholder }} {% endif %} @@ -125,7 +125,7 @@ {% if object.disk %} {{ object.disk }} GB {% else %} - — + {{ ''|placeholder }} {% endif %} diff --git a/netbox/templates/wireless/inc/wirelesslink_interface.html b/netbox/templates/wireless/inc/wirelesslink_interface.html index db4f84f0a..7732816a7 100644 --- a/netbox/templates/wireless/inc/wirelesslink_interface.html +++ b/netbox/templates/wireless/inc/wirelesslink_interface.html @@ -33,7 +33,7 @@ {% if interface.rf_channel_frequency %} {{ interface.rf_channel_frequency|simplify_decimal }} MHz {% else %} - — + {{ ''|placeholder }} {% endif %} @@ -43,7 +43,7 @@ {% if interface.rf_channel_width %} {{ interface.rf_channel_width|simplify_decimal }} MHz {% else %} - — + {{ ''|placeholder }} {% endif %} diff --git a/netbox/tenancy/tables/contacts.py b/netbox/tenancy/tables/contacts.py index 17abc5a5b..234dc2ad7 100644 --- a/netbox/tenancy/tables/contacts.py +++ b/netbox/tenancy/tables/contacts.py @@ -18,7 +18,7 @@ class ContactGroupTable(NetBoxTable): ) contact_count = columns.LinkedCountColumn( viewname='tenancy:contact_list', - url_params={'role_id': 'pk'}, + url_params={'group_id': 'pk'}, verbose_name='Contacts' ) tags = columns.TagColumn( diff --git a/netbox/tenancy/views.py b/netbox/tenancy/views.py index 58ad98e8f..f6f95b123 100644 --- a/netbox/tenancy/views.py +++ b/netbox/tenancy/views.py @@ -3,7 +3,7 @@ from django.shortcuts import get_object_or_404 from circuits.models import Circuit from dcim.models import Cable, Device, Location, Rack, RackReservation, Site -from ipam.models import Aggregate, IPAddress, Prefix, VLAN, VRF, ASN +from ipam.models import Aggregate, IPAddress, IPRange, Prefix, VLAN, VRF, ASN from netbox.views import generic from utilities.utils import count_related from virtualization.models import VirtualMachine, Cluster @@ -104,8 +104,9 @@ class TenantView(generic.ObjectView): 'location_count': Location.objects.restrict(request.user, 'view').filter(tenant=instance).count(), 'device_count': Device.objects.restrict(request.user, 'view').filter(tenant=instance).count(), 'vrf_count': VRF.objects.restrict(request.user, 'view').filter(tenant=instance).count(), - 'prefix_count': Prefix.objects.restrict(request.user, 'view').filter(tenant=instance).count(), 'aggregate_count': Aggregate.objects.restrict(request.user, 'view').filter(tenant=instance).count(), + 'prefix_count': Prefix.objects.restrict(request.user, 'view').filter(tenant=instance).count(), + 'iprange_count': IPRange.objects.restrict(request.user, 'view').filter(tenant=instance).count(), 'ipaddress_count': IPAddress.objects.restrict(request.user, 'view').filter(tenant=instance).count(), 'vlan_count': VLAN.objects.restrict(request.user, 'view').filter(tenant=instance).count(), 'circuit_count': Circuit.objects.restrict(request.user, 'view').filter(tenant=instance).count(), diff --git a/netbox/utilities/forms/fields/fields.py b/netbox/utilities/forms/fields/fields.py index 0d09d2ac7..9168189a1 100644 --- a/netbox/utilities/forms/fields/fields.py +++ b/netbox/utilities/forms/fields/fields.py @@ -3,6 +3,7 @@ import json from django import forms from django.db.models import Count from django.forms.fields import JSONField as _JSONField, InvalidJSONInput +from django.templatetags.static import static from netaddr import AddrFormatError, EUI from utilities.forms import widgets @@ -26,10 +27,9 @@ class CommentField(forms.CharField): A textarea with support for Markdown rendering. Exists mostly just to add a standard `help_text`. """ widget = forms.Textarea - # TODO: Port Markdown cheat sheet to internal documentation - help_text = """ + help_text = f""" - + Markdown syntax is supported """ diff --git a/netbox/utilities/templatetags/builtins/filters.py b/netbox/utilities/templatetags/builtins/filters.py index 44ad5ac47..738dc0e00 100644 --- a/netbox/utilities/templatetags/builtins/filters.py +++ b/netbox/utilities/templatetags/builtins/filters.py @@ -11,7 +11,7 @@ from markdown import markdown from netbox.config import get_config from utilities.markdown import StrikethroughExtension -from utilities.utils import foreground_color +from utilities.utils import clean_html, foreground_color register = template.Library() @@ -144,18 +144,6 @@ def render_markdown(value): {{ md_source_text|markdown }} """ - schemes = '|'.join(get_config().ALLOWED_URL_SCHEMES) - - # Strip HTML tags - value = strip_tags(value) - - # Sanitize Markdown links - pattern = fr'\[([^\]]+)\]\(\s*(?!({schemes})).*:(.+)\)' - value = re.sub(pattern, '[\\1](\\3)', value, flags=re.IGNORECASE) - - # Sanitize Markdown reference links - pattern = fr'\[([^\]]+)\]:\s*(?!({schemes}))\w*:(.+)' - value = re.sub(pattern, '[\\1]: \\3', value, flags=re.IGNORECASE) # Render Markdown html = markdown(value, extensions=['def_list', 'fenced_code', 'tables', StrikethroughExtension()]) @@ -164,6 +152,11 @@ def render_markdown(value): if html: html = f'{html}
'
+ schemes = get_config().ALLOWED_URL_SCHEMES
+
+ # Sanitize HTML
+ html = clean_html(html, schemes)
+
return mark_safe(html)
diff --git a/netbox/utilities/utils.py b/netbox/utilities/utils.py
index 7b37c0b70..2b939471c 100644
--- a/netbox/utilities/utils.py
+++ b/netbox/utilities/utils.py
@@ -4,6 +4,7 @@ from collections import OrderedDict
from decimal import Decimal
from itertools import count, groupby
+import bleach
from django.core.serializers import serialize
from django.db.models import Count, OuterRef, Subquery
from django.db.models.functions import Coalesce
@@ -14,6 +15,7 @@ from mptt.models import MPTTModel
from dcim.choices import CableLengthUnitChoices
from extras.plugins import PluginConfig
from extras.utils import is_taggable
+from netbox.config import get_config
from utilities.constants import HTTP_REQUEST_META_SAFE_COPY
@@ -257,7 +259,9 @@ def render_jinja2(template_code, context):
"""
Render a Jinja2 template with the provided context. Return the rendered content.
"""
- return SandboxedEnvironment().from_string(source=template_code).render(**context)
+ environment = SandboxedEnvironment()
+ environment.filters.update(get_config().JINJA2_FILTERS)
+ return environment.from_string(source=template_code).render(**context)
def prepare_cloned_fields(instance):
@@ -382,3 +386,33 @@ def copy_safe_request(request):
'path': request.path,
'id': getattr(request, 'id', None), # UUID assigned by middleware
})
+
+
+def clean_html(html, schemes):
+ """
+ Sanitizes HTML based on a whitelist of allowed tags and attributes.
+ Also takes a list of allowed URI schemes.
+ """
+
+ ALLOWED_TAGS = [
+ "div", "pre", "code", "blockquote", "del",
+ "hr", "h1", "h2", "h3", "h4", "h5", "h6",
+ "ul", "ol", "li", "p", "br",
+ "strong", "em", "a", "b", "i", "img",
+ "table", "thead", "tbody", "tr", "th", "td",
+ "dl", "dt", "dd",
+ ]
+
+ ALLOWED_ATTRIBUTES = {
+ "div": ['class'],
+ "h1": ["id"], "h2": ["id"], "h3": ["id"], "h4": ["id"], "h5": ["id"], "h6": ["id"],
+ "a": ["href", "title"],
+ "img": ["src", "title", "alt"],
+ }
+
+ return bleach.clean(
+ html,
+ tags=ALLOWED_TAGS,
+ attributes=ALLOWED_ATTRIBUTES,
+ protocols=schemes
+ )
diff --git a/netbox/virtualization/forms/bulk_edit.py b/netbox/virtualization/forms/bulk_edit.py
index d5d33df2a..4894d78cf 100644
--- a/netbox/virtualization/forms/bulk_edit.py
+++ b/netbox/virtualization/forms/bulk_edit.py
@@ -3,7 +3,7 @@ from django import forms
from dcim.choices import InterfaceModeChoices
from dcim.constants import INTERFACE_MTU_MAX, INTERFACE_MTU_MIN
from dcim.models import DeviceRole, Platform, Region, Site, SiteGroup
-from ipam.models import VLAN, VRF
+from ipam.models import VLAN, VLANGroup, VRF
from netbox.forms import NetBoxModelBulkEditForm
from tenancy.models import Tenant
from utilities.forms import (
@@ -182,13 +182,26 @@ class VMInterfaceBulkEditForm(NetBoxModelBulkEditForm):
required=False,
widget=StaticSelect()
)
+ vlan_group = DynamicModelChoiceField(
+ queryset=VLANGroup.objects.all(),
+ required=False,
+ label='VLAN group'
+ )
untagged_vlan = DynamicModelChoiceField(
queryset=VLAN.objects.all(),
- required=False
+ required=False,
+ query_params={
+ 'group_id': '$vlan_group',
+ },
+ label='Untagged VLAN'
)
tagged_vlans = DynamicModelMultipleChoiceField(
queryset=VLAN.objects.all(),
- required=False
+ required=False,
+ query_params={
+ 'group_id': '$vlan_group',
+ },
+ label='Tagged VLANs'
)
vrf = DynamicModelChoiceField(
queryset=VRF.objects.all(),
@@ -200,7 +213,7 @@ class VMInterfaceBulkEditForm(NetBoxModelBulkEditForm):
fieldsets = (
(None, ('mtu', 'enabled', 'vrf', 'description')),
('Related Interfaces', ('parent', 'bridge')),
- ('802.1Q Switching', ('mode', 'untagged_vlan', 'tagged_vlans')),
+ ('802.1Q Switching', ('mode', 'vlan_group', 'untagged_vlan', 'tagged_vlans')),
)
nullable_fields = (
'parent', 'bridge', 'mtu', 'vrf', 'description',
diff --git a/netbox/virtualization/forms/models.py b/netbox/virtualization/forms/models.py
index 314b0bddf..d2ebe5345 100644
--- a/netbox/virtualization/forms/models.py
+++ b/netbox/virtualization/forms/models.py
@@ -307,7 +307,7 @@ class VMInterfaceForm(InterfaceCommonForm, NetBoxModelForm):
model = VMInterface
fields = [
'virtual_machine', 'name', 'parent', 'bridge', 'enabled', 'mac_address', 'mtu', 'description', 'mode',
- 'untagged_vlan', 'tagged_vlans', 'vrf', 'tags',
+ 'vlan_group', 'untagged_vlan', 'tagged_vlans', 'vrf', 'tags',
]
widgets = {
'virtual_machine': forms.HiddenInput(),
diff --git a/requirements.txt b/requirements.txt
index 293a33542..1fdace4f0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,8 @@
-Django==4.0.4
-django-cors-headers==3.12.0
-django-debug-toolbar==3.2.4
-django-filter==21.1
+bleach==5.0.0
+Django==4.0.5
+django-cors-headers==3.13.0
+django-debug-toolbar==3.4.0
+django-filter==22.1
django-graphiql-debug-toolbar==0.2.0
django-mptt==0.13.4
django-pglocks==1.0.4
@@ -18,7 +19,7 @@ gunicorn==20.1.0
Jinja2==3.1.2
Markdown==3.3.7
markdown-include==0.6.0
-mkdocs-material==8.2.16
+mkdocs-material==8.3.6
mkdocstrings[python-legacy]==0.19.0
netaddr==0.8.0
Pillow==9.1.1
@@ -26,7 +27,7 @@ psycopg2-binary==2.9.3
PyYAML==6.0
sentry-sdk==1.5.12
social-auth-app-django==5.0.0
-social-auth-core==4.2.0
+social-auth-core==4.3.0
svgwrite==1.4.2
tablib==3.2.1
tzdata==2022.1