From fc0cbdf5338761bcd02b8a2fdbe7e44007398af0 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Thu, 14 Jul 2022 14:12:45 -0400
Subject: [PATCH 01/14] Initial implementation of Quill widget

---
 hawc/apps/assessment/forms.py | 11 +++++++--
 hawc/apps/common/forms.py     | 20 +++++++++++++++-
 hawc/apps/common/widgets.py   | 43 +++++++++++++++++++++++++++++++++++
 hawc/static/js/quilltext.js   |  3 +++
 4 files changed, 74 insertions(+), 3 deletions(-)
 create mode 100644 hawc/static/js/quilltext.js

diff --git a/hawc/apps/assessment/forms.py b/hawc/apps/assessment/forms.py
index 87274b913a..205d6844aa 100644
--- a/hawc/apps/assessment/forms.py
+++ b/hawc/apps/assessment/forms.py
@@ -13,7 +13,12 @@
 
 from hawc.services.epa.dsstox import DssSubstance
 
-from ..common.forms import BaseFormHelper, form_actions_apply_filters, form_actions_create_or_close
+from ..common.forms import (
+    BaseFormHelper,
+    QuillField,
+    form_actions_apply_filters,
+    form_actions_create_or_close,
+)
 from ..common.helper import new_window_a, tryParseInt
 from ..common.selectable import AutoCompleteSelectMultipleWidget, AutoCompleteWidget
 from ..common.widgets import DateCheckboxInput
@@ -45,6 +50,9 @@ class Meta:
         widgets = {
             "public_on": DateCheckboxInput,
         }
+        field_classes = {
+            "assessment_objective": QuillField,
+        }
 
     def __init__(self, *args, **kwargs):
         self.user = kwargs.pop("user", None)
@@ -88,7 +96,6 @@ def helper(self):
             widget = self.fields[fld].widget
             if type(widget) == forms.Textarea:
                 widget.attrs["rows"] = 3
-                widget.attrs["class"] = widget.attrs.get("class", "") + " html5text"
 
         if self.instance.id:
             inputs = {
diff --git a/hawc/apps/common/forms.py b/hawc/apps/common/forms.py
index f243257b06..6369d37f8e 100644
--- a/hawc/apps/common/forms.py
+++ b/hawc/apps/common/forms.py
@@ -7,7 +7,7 @@
 from django import forms
 from django.template.loader import render_to_string
 
-from . import selectable, validators
+from . import selectable, validators, widgets
 
 ASSESSMENT_UNIQUE_MESSAGE = "Must be unique for assessment (current value already exists)."
 
@@ -222,3 +222,21 @@ def format_value(self, value) -> List[str]:
         if value is None:
             return []
         return value.split(",")
+
+
+class QuillField(forms.CharField):
+    """
+    Quill text editor input.
+    Cleans HTML and validates urls.
+    """
+
+    widget = widgets.QuillWidget
+
+    def __init__(self, *args, **kwargs):
+        # Force use of Quill widget
+        kwargs["widget"] = self.widget
+        super().__init__(*args, **kwargs)
+
+    def validate(self, value):
+        super().validate(value)
+        validators.validate_hyperlinks(value)
diff --git a/hawc/apps/common/widgets.py b/hawc/apps/common/widgets.py
index f65adc0a95..67014785aa 100644
--- a/hawc/apps/common/widgets.py
+++ b/hawc/apps/common/widgets.py
@@ -1,6 +1,9 @@
 from random import randint
 from typing import List, Type
 
+import bleach
+from bleach.css_sanitizer import CSSSanitizer
+from django.conf import settings
 from django.forms import ValidationError
 from django.forms.widgets import (
     CheckboxInput,
@@ -8,6 +11,7 @@
     MultiWidget,
     Select,
     SelectMultiple,
+    Textarea,
     TextInput,
 )
 from django.utils import timezone
@@ -107,3 +111,42 @@ class SelectOtherWidget(ChoiceOtherWidget):
 class SelectMultipleOtherWidget(ChoiceOtherWidget):
     choice_widget = SelectMultiple
     template_name = "common/select_other_widget.html"
+
+
+class QuillWidget(Textarea):
+    """
+    Uses the Quill text editor for input.
+    Cleaning is done to remove invalid styles and tags; all inner text is kept.
+    """
+
+    class Media:
+        js = (f"{settings.STATIC_URL}js/quilltext.js",)
+
+    def build_attrs(self, base_attrs, extra_attrs=None):
+        attrs = super().build_attrs(base_attrs, extra_attrs)
+        class_name = attrs.get("class")
+        attrs["class"] = class_name + " quilltext" if class_name else "quilltext"
+        return attrs
+
+    def value_from_datadict(self, data, files, name):
+        value = data.get(name)
+        if value:
+            tags = [
+                "span",
+                "a",
+                "blockquote",
+                "sub",
+                "sup",
+                "strong",
+                "em",
+                "u",
+                "s",
+                "ol",
+                "ul",
+                "li",
+            ]
+            attrs = {"*": ["style"], "a": ["href", "rel", "target"]}
+            css_sanitizer = CSSSanitizer(allowed_css_properties=["color", "background-color"])
+            return bleach.clean(
+                value, tags=tags, attributes=attrs, css_sanitizer=css_sanitizer, strip=True
+            )
diff --git a/hawc/static/js/quilltext.js b/hawc/static/js/quilltext.js
new file mode 100644
index 0000000000..4de1e4039d
--- /dev/null
+++ b/hawc/static/js/quilltext.js
@@ -0,0 +1,3 @@
+(function($){$(document).ready(() => {
+    $("textarea.quilltext").quillify();
+});})(jQuery)

From d1b719b923a12087f6d891ce19ec9a0a5a4661c5 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Thu, 14 Jul 2022 15:37:38 -0400
Subject: [PATCH 02/14] Replace quill with field

---
 frontend/animal/EditEndpoint.js               |  4 ----
 hawc/apps/animal/forms.py                     | 17 ++++++++------
 .../templates/animal/animalgroup_form.html    |  2 --
 .../templates/animal/dosingregime_form.html   |  2 --
 .../templates/animal/experiment_form.html     |  1 -
 hawc/apps/assessment/forms.py                 | 22 +++++--------------
 .../assessment/_assessment_form_js.html       |  1 -
 .../assessment/assessment_detail.html         |  1 -
 .../templates/assessment/dataset_form.html    |  1 -
 hawc/apps/lit/forms.py                        |  7 ++----
 hawc/apps/lit/templates/lit/search_form.html  |  2 --
 hawc/apps/riskofbias/forms.py                 | 12 +++++-----
 .../templates/riskofbias/arob_text_form.html  |  8 -------
 .../riskofbias/riskofbiasdomain_form.html     |  1 -
 .../riskofbias/riskofbiasmetric_form.html     |  1 -
 hawc/apps/study/forms.py                      |  6 ++---
 .../study/templates/study/study_form.html     |  1 -
 17 files changed, 25 insertions(+), 64 deletions(-)

diff --git a/frontend/animal/EditEndpoint.js b/frontend/animal/EditEndpoint.js
index b5e875a364..148b4ce70b 100644
--- a/frontend/animal/EditEndpoint.js
+++ b/frontend/animal/EditEndpoint.js
@@ -23,10 +23,6 @@ class EditEndpoint {
         // reorganize forms
         $("#endpointGroups").insertBefore($("div.form-actions"));
 
-        // html5 enabled form
-        $("#id_results_notes").quillify();
-        $("#id_endpoint_notes").quillify();
-
         //update values in doses table
         $("#doses_title").html(`Dose<br>(${firstDoses.name})`);
         $(".doses").each(function(i, v) {
diff --git a/hawc/apps/animal/forms.py b/hawc/apps/animal/forms.py
index 0963ab4bd9..50ba267221 100644
--- a/hawc/apps/animal/forms.py
+++ b/hawc/apps/animal/forms.py
@@ -12,7 +12,12 @@
 from ..assessment.lookups import DssToxIdLookup, EffectTagLookup, SpeciesLookup, StrainLookup
 from ..assessment.models import DoseUnits
 from ..common import selectable
-from ..common.forms import BaseFormHelper, CopyAsNewSelectorForm, form_actions_apply_filters
+from ..common.forms import (
+    BaseFormHelper,
+    CopyAsNewSelectorForm,
+    QuillField,
+    form_actions_apply_filters,
+)
 from ..study.lookups import AnimalStudyLookup
 from ..vocab.constants import VocabularyNamespace
 from . import constants, lookups, models
@@ -22,6 +27,7 @@ class ExperimentForm(ModelForm):
     class Meta:
         model = models.Experiment
         exclude = ("study",)
+        field_classes = {"description": QuillField}
 
     def __init__(self, *args, **kwargs):
         parent = kwargs.pop("parent", None)
@@ -63,8 +69,6 @@ def helper(self):
             if type(widget) != forms.CheckboxInput:
                 widget.attrs["class"] = "form-control"
 
-        self.fields["description"].widget.attrs["rows"] = 4
-
         if self.instance.id:
             inputs = {
                 "legend_text": f"Update {self.instance}",
@@ -135,6 +139,7 @@ class Meta:
         model = models.AnimalGroup
         exclude = ("experiment", "dosing_regime", "generation", "parents")
         labels = {"lifestage_assessed": "Lifestage at assessment"}
+        field_classes = {"comments": QuillField}
 
     def __init__(self, *args, **kwargs):
         parent = kwargs.pop("parent", None)
@@ -166,8 +171,6 @@ def __init__(self, *args, **kwargs):
             experiment=self.instance.experiment
         )
 
-        self.fields["comments"].widget.attrs["rows"] = 4
-
     @property
     def helper(self):
         for fld in list(self.fields.keys()):
@@ -252,14 +255,13 @@ class DosingRegimeForm(ModelForm):
     class Meta:
         model = models.DosingRegime
         exclude = ("dosed_animals",)
+        field_classes = {"description": QuillField}
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
     @property
     def helper(self):
-
-        self.fields["description"].widget.attrs["rows"] = 4
         for fld in list(self.fields.keys()):
             self.fields[fld].widget.attrs["class"] = "form-control"
 
@@ -414,6 +416,7 @@ class Meta:
             "effect_term": forms.HiddenInput,
             "effect_subtype_term": forms.HiddenInput,
         }
+        field_classes = {"results_notes": QuillField, "endpoint_notes": QuillField}
 
     def __init__(self, *args, **kwargs):
         animal_group = kwargs.pop("parent", None)
diff --git a/hawc/apps/animal/templates/animal/animalgroup_form.html b/hawc/apps/animal/templates/animal/animalgroup_form.html
index 274e9242e4..862f7a5072 100644
--- a/hawc/apps/animal/templates/animal/animalgroup_form.html
+++ b/hawc/apps/animal/templates/animal/animalgroup_form.html
@@ -68,8 +68,6 @@
                 );
             };
 
-            $('#id_comments').quillify();
-            $('#id_description').quillify();
             $('#id_species')
                 .change(onSpeciesChange)
                 .trigger('change');
diff --git a/hawc/apps/animal/templates/animal/dosingregime_form.html b/hawc/apps/animal/templates/animal/dosingregime_form.html
index 1fe6051f22..be96a7e562 100644
--- a/hawc/apps/animal/templates/animal/dosingregime_form.html
+++ b/hawc/apps/animal/templates/animal/dosingregime_form.html
@@ -25,8 +25,6 @@
 
 {% block extrajs %}
   <script type="text/javascript">
-      $('#id_description').quillify();
-
       // reorganize forms
       var actions = $('.form-actions');
       $('#doseGroupsDiv').insertBefore($('.form-actions'))
diff --git a/hawc/apps/animal/templates/animal/experiment_form.html b/hawc/apps/animal/templates/animal/experiment_form.html
index f04f6c28a2..2757582bd5 100644
--- a/hawc/apps/animal/templates/animal/experiment_form.html
+++ b/hawc/apps/animal/templates/animal/experiment_form.html
@@ -11,7 +11,6 @@
   {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
-      $('#id_description').quillify();
       $('#id_name').focus();
       var pa = $('#id_purity_available'),
           addBlankOption = function(setAsBlank){
diff --git a/hawc/apps/assessment/forms.py b/hawc/apps/assessment/forms.py
index 205d6844aa..0a5259ede8 100644
--- a/hawc/apps/assessment/forms.py
+++ b/hawc/apps/assessment/forms.py
@@ -29,10 +29,9 @@
 
 class AssessmentForm(forms.ModelForm):
 
-    internal_communications = forms.CharField(
+    internal_communications = QuillField(
         required=False,
         help_text="Internal communications regarding this assessment; this field is only displayed to assessment team members.",
-        widget=forms.Textarea,
     )
 
     class Meta:
@@ -52,6 +51,9 @@ class Meta:
         }
         field_classes = {
             "assessment_objective": QuillField,
+            "authors": QuillField,
+            "conflicts_of_interest": QuillField,
+            "funding_source": QuillField,
         }
 
     def __init__(self, *args, **kwargs):
@@ -91,12 +93,6 @@ def save(self, commit=True):
 
     @property
     def helper(self):
-        # by default take-up the whole row
-        for fld in list(self.fields.keys()):
-            widget = self.fields[fld].widget
-            if type(widget) == forms.Textarea:
-                widget.attrs["rows"] = 3
-
         if self.instance.id:
             inputs = {
                 "legend_text": f"Update {self.instance}",
@@ -230,6 +226,7 @@ class AttachmentForm(forms.ModelForm):
     class Meta:
         model = models.Attachment
         exclude = ("content_type", "object_id", "content_object")
+        field_classes = {"description": QuillField}
 
     def __init__(self, *args, **kwargs):
         obj = kwargs.pop("parent", None)
@@ -241,7 +238,6 @@ def __init__(self, *args, **kwargs):
 
     @property
     def helper(self):
-        self.fields["description"].widget.attrs["class"] = "html5text"
         helper = BaseFormHelper(self)
         helper.form_tag = False
         helper.add_row("title", 2, "col-md-6")
@@ -448,13 +444,6 @@ def __init__(self, *args, **kwargs):
 
     @property
     def helper(self):
-        # by default take-up the whole row
-        for fld in self.fields.keys():
-            widget = self.fields[fld].widget
-            if type(widget) == forms.Textarea:
-                widget.attrs["rows"] = 3
-                widget.attrs["class"] = widget.attrs.get("class", "") + " html5text"
-
         if self.instance.id:
             inputs = {
                 "legend_text": f"Update {self.instance}",
@@ -544,6 +533,7 @@ def save(self, commit=True):
     class Meta:
         model = models.Dataset
         fields = ("name", "description", "published")
+        field_classes = {"description": QuillField}
 
 
 class LogFilterForm(forms.Form):
diff --git a/hawc/apps/assessment/templates/assessment/_assessment_form_js.html b/hawc/apps/assessment/templates/assessment/_assessment_form_js.html
index 9f34a5a8b1..4049f52d00 100644
--- a/hawc/apps/assessment/templates/assessment/_assessment_form_js.html
+++ b/hawc/apps/assessment/templates/assessment/_assessment_form_js.html
@@ -17,7 +17,6 @@
         $('#id_vocabulary').on('change', toggleCuration)
         toggleCuration();
 
-        $('.html5text').quillify();
         $('#id_name').focus();
     });
 </script>
diff --git a/hawc/apps/assessment/templates/assessment/assessment_detail.html b/hawc/apps/assessment/templates/assessment/assessment_detail.html
index f220908925..4f9f570a1e 100644
--- a/hawc/apps/assessment/templates/assessment/assessment_detail.html
+++ b/hawc/apps/assessment/templates/assessment/assessment_detail.html
@@ -248,7 +248,6 @@ <h3>Assessment details for team members*</h3>
     // attachment-form events
     const form = $(target).find('.attachment-form');
     if (form) {
-      form.find('.html5text').quillify();
       form.find("#id_title").focus();
     }
   });
diff --git a/hawc/apps/assessment/templates/assessment/dataset_form.html b/hawc/apps/assessment/templates/assessment/dataset_form.html
index 7374cfa93f..9414e06322 100644
--- a/hawc/apps/assessment/templates/assessment/dataset_form.html
+++ b/hawc/apps/assessment/templates/assessment/dataset_form.html
@@ -9,7 +9,6 @@
 {% block extrajs %}
 <script type="text/javascript">
     $(document).ready(function () {
-        $('.html5text').quillify();
         $('#id_name').focus();
 
         // show/hide excel worksheet name depending on what was file was selected
diff --git a/hawc/apps/lit/forms.py b/hawc/apps/lit/forms.py
index 7f058b657a..eb3b52e0f5 100644
--- a/hawc/apps/lit/forms.py
+++ b/hawc/apps/lit/forms.py
@@ -9,7 +9,7 @@
 
 from ...services.utils import ris
 from ..assessment.models import Assessment
-from ..common.forms import BaseFormHelper, addPopupLink
+from ..common.forms import BaseFormHelper, QuillField, addPopupLink
 from ..common.helper import read_excel
 from ..study.models import Study
 from . import constants, models
@@ -55,6 +55,7 @@ class SearchForm(forms.ModelForm):
     class Meta:
         model = models.Search
         fields = ("source", "title", "slug", "description", "search_string")
+        field_classes = {"description": QuillField, "search_string": QuillField}
 
     def __init__(self, *args, **kwargs):
         assessment = kwargs.pop("parent", None)
@@ -64,12 +65,8 @@ def __init__(self, *args, **kwargs):
             self.instance.assessment = assessment
 
         self.fields["source"].choices = [(1, "PubMed")]  # only current choice
-        self.fields["description"].widget.attrs["rows"] = 3
-        self.fields["description"].widget.attrs["class"] = "html5text"
         if "search_string" in self.fields:
-            self.fields["search_string"].widget.attrs["rows"] = 5
             self.fields["search_string"].required = True
-            self.fields["search_string"].widget.attrs["class"] = "html5text"
 
     @property
     def helper(self):
diff --git a/hawc/apps/lit/templates/lit/search_form.html b/hawc/apps/lit/templates/lit/search_form.html
index d9a9410f65..838de645bf 100644
--- a/hawc/apps/lit/templates/lit/search_form.html
+++ b/hawc/apps/lit/templates/lit/search_form.html
@@ -9,8 +9,6 @@
 {% block extrajs %}
   <script type="text/javascript">
     $(document).ready(function(){
-        $('.html5text').quillify();
-
         $('#id_title').on('keyup', function () {
           $('#id_slug').val(window.app.HAWCUtils.urlify($(this).val()));
         });
diff --git a/hawc/apps/riskofbias/forms.py b/hawc/apps/riskofbias/forms.py
index dc4246b8ac..e480f29d72 100644
--- a/hawc/apps/riskofbias/forms.py
+++ b/hawc/apps/riskofbias/forms.py
@@ -4,7 +4,7 @@
 from django.urls import reverse
 
 from ..assessment.models import Assessment
-from ..common.forms import BaseFormHelper
+from ..common.forms import BaseFormHelper, QuillField
 from . import models
 from .actions import RobApproach, clone_approach, load_approach
 
@@ -13,10 +13,7 @@ class RobTextForm(forms.ModelForm):
     class Meta:
         model = models.RiskOfBiasAssessment
         fields = ("help_text",)
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields["help_text"].widget.attrs["class"] = "html5text"
+        field_classes = {"help_text": QuillField}
 
     @property
     def helper(self):
@@ -37,6 +34,7 @@ class Meta:
             "description",
         )
         exclude = ("assessment",)
+        field_classes = {"description": QuillField}
 
     def __init__(self, *args, **kwargs):
         assessment = kwargs.pop("parent", None)
@@ -58,7 +56,7 @@ def helper(self):
             inputs["help_text"] = f"Create a new {rob_name} domain."
 
         helper = BaseFormHelper(self, **inputs)
-        helper["description"].wrap(cfl.Field, css_class="html5text col-md-12")
+        helper["description"].wrap(cfl.Field, css_class="col-md-12")
         helper.add_row("name", 2, "col-md-6")
         return helper
 
@@ -78,6 +76,7 @@ class RoBMetricForm(forms.ModelForm):
     class Meta:
         model = models.RiskOfBiasMetric
         exclude = ("domain", "hide_description", "sort_order")
+        field_classes = {"description": QuillField}
 
     def __init__(self, *args, **kwargs):
         domain = kwargs.pop("parent", None)
@@ -100,7 +99,6 @@ def helper(self):
         else:
             inputs["legend_text"] = f"Create new {rob_name} metric"
             inputs["help_text"] = f"Create a new {rob_name} metric."
-        self.fields["description"].widget.attrs.update({"class": "html5text"})
         helper = BaseFormHelper(self, **inputs)
         helper.add_row("name", 2, "col-md-6")
         helper.add_row("description", 2, ["col-md-8", "col-md-4"])
diff --git a/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html b/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
index 04efddf86d..f735f158e0 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
@@ -5,11 +5,3 @@
 {% block content %}
     {% crispy form %}
 {% endblock %}
-
-{% block extrajs %}
-<script type="text/javascript">
-$(document).ready(function() {
-    $('.html5text').quillify();
-});
-</script>
-{% endblock extrajs %}
diff --git a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
index 022f19578e..cda2a180f0 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
@@ -9,7 +9,6 @@
 {% block extrajs %}
 <script type="text/javascript">
 $(document).ready(function() {
-    $('.html5text').quillify();
     $('#id_name').focus();
 });
 </script>
diff --git a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
index 677ab01dbe..6ae7d8a13f 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
@@ -69,7 +69,6 @@
 <script type="text/javascript">
 $(document).ready(function() {
     $('#detail_display').insertAfter($('#div_id_responses')).removeClass('hidden');
-    $('.html5text').quillify();
     $('#id_name').focus();
     // handle selector change
     window.app.HAWCUtils.onSelectChangeShowDetail(
diff --git a/hawc/apps/study/forms.py b/hawc/apps/study/forms.py
index f2f9f0721b..a0863892cb 100644
--- a/hawc/apps/study/forms.py
+++ b/hawc/apps/study/forms.py
@@ -4,7 +4,7 @@
 from django.urls import reverse
 
 from ..assessment.models import Assessment
-from ..common.forms import BaseFormHelper, form_actions_apply_filters
+from ..common.forms import BaseFormHelper, QuillField, form_actions_apply_filters
 from ..lit.constants import ReferenceDatabase
 from ..lit.forms import create_external_id, validate_external_id
 from ..lit.models import Reference
@@ -38,6 +38,7 @@ class Meta:
             "summary",
             "published",
         )
+        field_classes = {"summary": QuillField, "internal_communications": QuillField}
 
     def __init__(self, *args, **kwargs):
         parent = kwargs.pop("parent", None)
@@ -64,9 +65,6 @@ def setHelper(self, inputs={}):
 
         helper = BaseFormHelper(self, **inputs)
 
-        for fld in ("summary", "internal_communications"):
-            self.fields[fld].widget.attrs["class"] += " html5text"
-
         if "authors" in self.fields:
             helper.add_row("authors", 2, "col-md-6")
         helper.add_row("short_citation", 2, "col-md-6")
diff --git a/hawc/apps/study/templates/study/study_form.html b/hawc/apps/study/templates/study/study_form.html
index 36979deff8..b3c0d65c83 100644
--- a/hawc/apps/study/templates/study/study_form.html
+++ b/hawc/apps/study/templates/study/study_form.html
@@ -9,7 +9,6 @@
 {% block extrajs %}
 <script type="text/javascript">
 $(document).ready(function(){
-    $('.html5text').quillify();
     document.getElementById("id_short_citation").focus()
 });
 </script>

From 7f5d81ca793121559cdefa53c89df52fd0f0731e Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Thu, 14 Jul 2022 16:09:26 -0400
Subject: [PATCH 03/14] Added bleach to requirements

---
 requirements/base.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/requirements/base.txt b/requirements/base.txt
index 870b51c2e7..ab7d2a29a3 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -26,6 +26,7 @@ redis==4.1.4
 requests==2.27.1
 pydantic==1.9.0
 myst-parser==0.16.1
+bleach[css]==5.0.1
 
 # computational
 numpy==1.22.2

From a041514018710ef98811de76d6218058f46054e4 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Thu, 14 Jul 2022 16:44:45 -0400
Subject: [PATCH 04/14] Fixed import form

---
 hawc/apps/lit/forms.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hawc/apps/lit/forms.py b/hawc/apps/lit/forms.py
index 29a916da9b..a24124e27b 100644
--- a/hawc/apps/lit/forms.py
+++ b/hawc/apps/lit/forms.py
@@ -92,6 +92,9 @@ def helper(self):
 
 
 class ImportForm(SearchForm):
+    class Meta(SearchForm.Meta):
+        field_classes = {"description": QuillField}
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.fields["source"].choices = [(1, "PubMed"), (2, "HERO")]
@@ -101,7 +104,6 @@ def __init__(self, *args, **kwargs):
                 "search_string"
             ].help_text = "Enter a comma-separated list of database IDs for import."  # noqa
             self.fields["search_string"].label = "ID List"
-            self.fields["search_string"].widget.attrs.pop("class")
         else:
             self.fields.pop("search_string")
 

From fc7656562361e47005be0735584607d3549d1347 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Fri, 15 Jul 2022 17:45:00 -0400
Subject: [PATCH 05/14] Fix quill fields on all forms

---
 hawc/apps/animal/templates/animal/dosingregime_form.html    | 1 +
 hawc/apps/assessment/templates/assessment/dataset_form.html | 1 +
 hawc/apps/lit/templates/lit/search_form.html                | 1 +
 .../riskofbias/templates/riskofbias/arob_text_form.html     | 4 ++++
 .../templates/riskofbias/riskofbiasdomain_form.html         | 1 +
 .../templates/riskofbias/riskofbiasmetric_form.html         | 1 +
 hawc/apps/study/forms.py                                    | 6 +++---
 hawc/apps/study/templates/study/study_form.html             | 1 +
 8 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/hawc/apps/animal/templates/animal/dosingregime_form.html b/hawc/apps/animal/templates/animal/dosingregime_form.html
index be96a7e562..394b753c98 100644
--- a/hawc/apps/animal/templates/animal/dosingregime_form.html
+++ b/hawc/apps/animal/templates/animal/dosingregime_form.html
@@ -24,6 +24,7 @@
 {% endblock %}
 
 {% block extrajs %}
+  {{ form.media }}
   <script type="text/javascript">
       // reorganize forms
       var actions = $('.form-actions');
diff --git a/hawc/apps/assessment/templates/assessment/dataset_form.html b/hawc/apps/assessment/templates/assessment/dataset_form.html
index 9414e06322..70d43fc579 100644
--- a/hawc/apps/assessment/templates/assessment/dataset_form.html
+++ b/hawc/apps/assessment/templates/assessment/dataset_form.html
@@ -7,6 +7,7 @@
 
 
 {% block extrajs %}
+{{ form.media }}
 <script type="text/javascript">
     $(document).ready(function () {
         $('#id_name').focus();
diff --git a/hawc/apps/lit/templates/lit/search_form.html b/hawc/apps/lit/templates/lit/search_form.html
index 838de645bf..5b3e3b308c 100644
--- a/hawc/apps/lit/templates/lit/search_form.html
+++ b/hawc/apps/lit/templates/lit/search_form.html
@@ -7,6 +7,7 @@
 {% endblock %}
 
 {% block extrajs %}
+  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
         $('#id_title').on('keyup', function () {
diff --git a/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html b/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
index f735f158e0..041c22d060 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
@@ -5,3 +5,7 @@
 {% block content %}
     {% crispy form %}
 {% endblock %}
+
+{% block extrajs %}
+    {{ form.media }}
+{% endblock extrajs %}
diff --git a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
index cda2a180f0..f1b490f81a 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
@@ -7,6 +7,7 @@
 {% endblock %}
 
 {% block extrajs %}
+{{ form.media }}
 <script type="text/javascript">
 $(document).ready(function() {
     $('#id_name').focus();
diff --git a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
index 6ae7d8a13f..b75835d6cf 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
@@ -66,6 +66,7 @@
 {% endblock %}
 
 {% block extrajs %}
+{{ form.media }}
 <script type="text/javascript">
 $(document).ready(function() {
     $('#detail_display').insertAfter($('#div_id_responses')).removeClass('hidden');
diff --git a/hawc/apps/study/forms.py b/hawc/apps/study/forms.py
index a0863892cb..3185d38216 100644
--- a/hawc/apps/study/forms.py
+++ b/hawc/apps/study/forms.py
@@ -13,8 +13,7 @@
 
 class BaseStudyForm(forms.ModelForm):
 
-    internal_communications = forms.CharField(
-        widget=forms.Textarea,
+    internal_communications = QuillField(
         required=False,
         help_text="Internal communications regarding this study; this field is only displayed to assessment team members. Could be to describe extraction notes to e.g., reference to full study reports or indicating which outcomes/endpoints in a study were not extracted.",
     )
@@ -38,7 +37,7 @@ class Meta:
             "summary",
             "published",
         )
-        field_classes = {"summary": QuillField, "internal_communications": QuillField}
+        field_classes = {"summary": QuillField}
 
     def __init__(self, *args, **kwargs):
         parent = kwargs.pop("parent", None)
@@ -132,6 +131,7 @@ class Meta:
             "summary",
             "published",
         )
+        field_classes = {"summary": QuillField}
 
     def setHelper(self):
         self.fields["title"].widget = TextInput()
diff --git a/hawc/apps/study/templates/study/study_form.html b/hawc/apps/study/templates/study/study_form.html
index b3c0d65c83..547aa3d626 100644
--- a/hawc/apps/study/templates/study/study_form.html
+++ b/hawc/apps/study/templates/study/study_form.html
@@ -7,6 +7,7 @@
 {% endblock %}
 
 {% block extrajs %}
+{{ form.media }}
 <script type="text/javascript">
 $(document).ready(function(){
     document.getElementById("id_short_citation").focus()

From 6f7833e8366071de3c825d106283c1d2a31b4b68 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Mon, 18 Jul 2022 00:31:13 -0400
Subject: [PATCH 06/14] Moved cleaning from widget to field, used existing
 constants for html validation, added tests

---
 hawc/apps/common/forms.py            |  8 ++++-
 hawc/apps/common/validators.py       | 53 +++++++++++++++++++++++-----
 hawc/apps/common/widgets.py          | 25 -------------
 hawc/apps/summary/models.py          |  4 +--
 tests/hawc/apps/common/test_forms.py | 41 +++++++++++++++++++++
 5 files changed, 95 insertions(+), 36 deletions(-)
 create mode 100644 tests/hawc/apps/common/test_forms.py

diff --git a/hawc/apps/common/forms.py b/hawc/apps/common/forms.py
index 6369d37f8e..a2d50c8e6a 100644
--- a/hawc/apps/common/forms.py
+++ b/hawc/apps/common/forms.py
@@ -237,6 +237,12 @@ def __init__(self, *args, **kwargs):
         kwargs["widget"] = self.widget
         super().__init__(*args, **kwargs)
 
+    def to_python(self, value):
+        value = super().to_python(value)
+        if value:
+            return validators.clean_html(value)
+
     def validate(self, value):
         super().validate(value)
-        validators.validate_hyperlinks(value)
+        if value:
+            validators.validate_hyperlinks(value)
diff --git a/hawc/apps/common/validators.py b/hawc/apps/common/validators.py
index 21f9217efc..d79f080d9a 100644
--- a/hawc/apps/common/validators.py
+++ b/hawc/apps/common/validators.py
@@ -2,6 +2,8 @@
 from typing import Sequence
 from urllib import parse
 
+import bleach
+from bleach.css_sanitizer import CSSSanitizer
 from django.core.exceptions import ValidationError
 from django.core.validators import RegexValidator, URLValidator
 from django.utils.encoding import force_str
@@ -9,8 +11,9 @@
 tag_regex = re.compile(r"</?(?P<tag>\w+)[^>]*>")
 hyperlink_regex = re.compile(r"href\s*=\s*['\"](.*?)['\"]")
 
-valid_html_tags_re = {
+valid_html_tags = {
     "a",
+    "blockquote",
     "br",
     "em",
     "h1",
@@ -23,9 +26,14 @@
     "p",
     "span",
     "strong",
+    "sub",
+    "sup",
+    "s",
     "ul",
     "u",
 }
+valid_html_attrs = {"*": ["style"], "a": ["href", "rel", "target"]}
+valid_css_properties = {"color", "background-color"}
 valid_scheme = {"", "http", "https"}
 valid_netloc_endings = {
     ".gov",
@@ -37,17 +45,44 @@
 }
 
 
-def validate_html_tags(text: str) -> str:
+def clean_html(html: str) -> str:
+    """
+    Cleans given HTML by removing invalid HTML tags, HTML properties, and CSS properties.
+
+    Note: inner text within invalid HTML tags will still be included.
+
+    Args:
+        html (str): HTML to clean
+
+    Returns:
+        str: cleaned HTML
+    """
+    css_sanitizer = CSSSanitizer(allowed_css_properties=valid_css_properties)
+    return bleach.clean(
+        html,
+        tags=valid_html_tags,
+        attributes=valid_html_attrs,
+        css_sanitizer=css_sanitizer,
+        strip=True,
+    )
+
+
+def validate_html_tags(html: str, field: str = None) -> str:
     """Html contains a subset of acceptable tags.
 
+    Args:
+        html (str): html text to validate
+        field (str, optional): field to use as key for error dict. Defaults to None.
+
     Raises:
         ValidationError if invalid tag found
     """
-    html_tags = tag_regex.findall(text)
-    invalid_html_tags = set(html_tags) - valid_html_tags_re
+    html_tags = tag_regex.findall(html)
+    invalid_html_tags = set(html_tags) - valid_html_tags
     if len(invalid_html_tags) > 0:
-        raise ValidationError({"content": f"Invalid html tags: {', '.join(invalid_html_tags)}"})
-    return text
+        err_msg = f"Invalid html tags: {', '.join(invalid_html_tags)}"
+        raise ValidationError(err_msg if field is None else {field: err_msg})
+    return html
 
 
 def valid_url(url_str: str) -> bool:
@@ -65,7 +100,7 @@ def valid_url(url_str: str) -> bool:
     return url.netloc == "" or any(url.netloc.endswith(ending) for ending in valid_netloc_endings)
 
 
-def validate_hyperlinks(html: str) -> str:
+def validate_hyperlinks(html: str, field: str = None) -> str:
     """
     Validate that our hyperlinks are on the allowlist of acceptable link locations.
 
@@ -73,6 +108,7 @@ def validate_hyperlinks(html: str) -> str:
 
     Args:
         html (str): html text to validate
+        field (str, optional): field to use as key for error dict. Defaults to None.
 
     Raises:
         ValidationError: If any hyperlinks links to an invalid link location.
@@ -85,7 +121,8 @@ def validate_hyperlinks(html: str) -> str:
         if not valid_url(hyperlink):
             invalid_links.append(hyperlink)
     if invalid_links:
-        raise ValidationError({"content": f"Invalid hyperlinks: {', '.join(invalid_links)}"})
+        err_msg = f"Invalid hyperlinks: {', '.join(invalid_links)}"
+        raise ValidationError(err_msg if field is None else {field: err_msg})
     return html
 
 
diff --git a/hawc/apps/common/widgets.py b/hawc/apps/common/widgets.py
index 67014785aa..efbedc86da 100644
--- a/hawc/apps/common/widgets.py
+++ b/hawc/apps/common/widgets.py
@@ -1,8 +1,6 @@
 from random import randint
 from typing import List, Type
 
-import bleach
-from bleach.css_sanitizer import CSSSanitizer
 from django.conf import settings
 from django.forms import ValidationError
 from django.forms.widgets import (
@@ -127,26 +125,3 @@ def build_attrs(self, base_attrs, extra_attrs=None):
         class_name = attrs.get("class")
         attrs["class"] = class_name + " quilltext" if class_name else "quilltext"
         return attrs
-
-    def value_from_datadict(self, data, files, name):
-        value = data.get(name)
-        if value:
-            tags = [
-                "span",
-                "a",
-                "blockquote",
-                "sub",
-                "sup",
-                "strong",
-                "em",
-                "u",
-                "s",
-                "ol",
-                "ul",
-                "li",
-            ]
-            attrs = {"*": ["style"], "a": ["href", "rel", "target"]}
-            css_sanitizer = CSSSanitizer(allowed_css_properties=["color", "background-color"])
-            return bleach.clean(
-                value, tags=tags, attributes=attrs, css_sanitizer=css_sanitizer, strip=True
-            )
diff --git a/hawc/apps/summary/models.py b/hawc/apps/summary/models.py
index 67d6d3a7ff..0c78647e1f 100644
--- a/hawc/apps/summary/models.py
+++ b/hawc/apps/summary/models.py
@@ -247,8 +247,8 @@ def clean(self):
         content_str = json.dumps(self.content).replace('\\"', '"')
 
         # validate tags used in text
-        validate_html_tags(content_str)
-        validate_hyperlinks(content_str)
+        validate_html_tags(content_str, "content")
+        validate_hyperlinks(content_str, "content")
 
 
 class HeatmapDataset(PydanticModel):
diff --git a/tests/hawc/apps/common/test_forms.py b/tests/hawc/apps/common/test_forms.py
new file mode 100644
index 0000000000..0f9444c297
--- /dev/null
+++ b/tests/hawc/apps/common/test_forms.py
@@ -0,0 +1,41 @@
+import pytest
+from django.core.exceptions import ValidationError
+
+from hawc.apps.common.forms import QuillField
+
+
+class TestQuillField:
+    def test_validate(self):
+        fld = QuillField()
+
+        # invalid scheme
+        html = '<a href="ftp://www.example.gov">link</a>'
+        with pytest.raises(ValidationError):
+            fld.validate(html)
+
+        # invalid TLD
+        html = '<a href="http://www.example.com">link</a>'
+        with pytest.raises(ValidationError):
+            fld.validate(html)
+
+        # valid
+        html = '<a href="http://www.example.gov">link</a>'
+        fld.validate(html)
+
+    def test_to_python(self):
+        fld = QuillField()
+
+        # tags should be cleaned
+        html = "<script>alert();</script>"
+        cleaned_html = fld.to_python(html)
+        assert cleaned_html == "alert();"
+
+        # attrs should be cleaned
+        html = '<a href="www.example.com" title="title">link</a>'
+        cleaned_html = fld.to_python(html)
+        assert cleaned_html == '<a href="www.example.com">link</a>'
+
+        # styles should be cleaned
+        html = '<span style="color:blue;display:none">test</span>'
+        cleaned_html = fld.to_python(html)
+        assert cleaned_html == '<span style="color:blue;">test</span>'

From d62b2a4017f7b9b0009efbb0cb6e65d62de62036 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Mon, 18 Jul 2022 00:46:48 -0400
Subject: [PATCH 07/14] quick fix

---
 hawc/apps/common/forms.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hawc/apps/common/forms.py b/hawc/apps/common/forms.py
index a2d50c8e6a..4ab5d16284 100644
--- a/hawc/apps/common/forms.py
+++ b/hawc/apps/common/forms.py
@@ -239,8 +239,7 @@ def __init__(self, *args, **kwargs):
 
     def to_python(self, value):
         value = super().to_python(value)
-        if value:
-            return validators.clean_html(value)
+        return validators.clean_html(value) if value else value
 
     def validate(self, value):
         super().validate(value)

From 8360797a36a9b4a3f87560eb5b6b95195d7c4301 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Wed, 20 Jul 2022 12:47:14 -0400
Subject: [PATCH 08/14] Moved form media check to base.html

---
 .../animal/templates/animal/animalgroup_copy_selector.html    | 1 -
 hawc/apps/animal/templates/animal/animalgroup_form.html       | 1 -
 hawc/apps/animal/templates/animal/dosingregime_form.html      | 1 -
 hawc/apps/animal/templates/animal/endpoint_copy_selector.html | 1 -
 hawc/apps/animal/templates/animal/endpoint_form.html          | 1 -
 hawc/apps/animal/templates/animal/endpoint_list.html          | 1 -
 .../animal/templates/animal/experiment_copy_selector.html     | 1 -
 hawc/apps/animal/templates/animal/experiment_form.html        | 1 -
 .../templates/assessment/assessment_create_form.html          | 1 -
 .../apps/assessment/templates/assessment/assessment_form.html | 1 -
 .../assessment/templates/assessment/assessment_log_list.html  | 4 ----
 hawc/apps/assessment/templates/assessment/dataset_form.html   | 1 -
 hawc/apps/assessment/templates/assessment/doseunits_form.html | 4 ----
 hawc/apps/assessment/templates/assessment/effecttag_form.html | 1 -
 hawc/apps/epi/templates/epi/adjustmentfactor_form.html        | 3 ---
 .../templates/epi/comparisonset_outcome_copy_selector.html    | 1 -
 .../epi/templates/epi/comparisonset_sp_copy_selector.html     | 1 -
 hawc/apps/epi/templates/epi/criteria_form.html                | 3 ---
 hawc/apps/epi/templates/epi/exposure_copy_selector.html       | 1 -
 hawc/apps/epi/templates/epi/exposure_form.html                | 2 --
 hawc/apps/epi/templates/epi/outcome_copy_selector.html        | 1 -
 hawc/apps/epi/templates/epi/outcome_form.html                 | 4 ----
 hawc/apps/epi/templates/epi/outcome_list.html                 | 1 -
 hawc/apps/epi/templates/epi/result_copy_selector.html         | 1 -
 hawc/apps/epi/templates/epi/result_form.html                  | 1 -
 .../apps/epi/templates/epi/studypopulation_copy_selector.html | 1 -
 hawc/apps/epi/templates/epi/studypopulation_form.html         | 1 -
 hawc/apps/epimeta/templates/epimeta/metaprotocol_form.html    | 1 -
 .../epimeta/templates/epimeta/metaresult_copy_selector.html   | 1 -
 hawc/apps/epimeta/templates/epimeta/metaresult_form.html      | 1 -
 hawc/apps/epimeta/templates/epimeta/metaresult_list.html      | 1 -
 hawc/apps/epiv2/templates/epiv2/design_form.html              | 1 -
 hawc/apps/invitro/templates/invitro/ivcelltype_form.html      | 4 ----
 hawc/apps/invitro/templates/invitro/ivchemical_form.html      | 2 +-
 hawc/apps/invitro/templates/invitro/ivendpoint_form.html      | 1 -
 hawc/apps/invitro/templates/invitro/ivendpoint_list.html      | 1 -
 hawc/apps/invitro/templates/invitro/ivexperiment_form.html    | 3 ---
 hawc/apps/lit/templates/lit/search_copy_selector.html         | 1 -
 hawc/apps/lit/templates/lit/search_form.html                  | 1 -
 hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html | 3 ---
 .../templates/riskofbias/riskofbiasdomain_form.html           | 1 -
 .../templates/riskofbias/riskofbiasmetric_form.html           | 1 -
 hawc/apps/study/templates/study/study_form.html               | 1 -
 hawc/templates/base.html                                      | 3 +++
 44 files changed, 4 insertions(+), 64 deletions(-)

diff --git a/hawc/apps/animal/templates/animal/animalgroup_copy_selector.html b/hawc/apps/animal/templates/animal/animalgroup_copy_selector.html
index 7345024d53..8a25f4bc59 100644
--- a/hawc/apps/animal/templates/animal/animalgroup_copy_selector.html
+++ b/hawc/apps/animal/templates/animal/animalgroup_copy_selector.html
@@ -15,7 +15,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/animal/templates/animal/animalgroup_form.html b/hawc/apps/animal/templates/animal/animalgroup_form.html
index 862f7a5072..d42607a26d 100644
--- a/hawc/apps/animal/templates/animal/animalgroup_form.html
+++ b/hawc/apps/animal/templates/animal/animalgroup_form.html
@@ -40,7 +40,6 @@
 {% endblock %}
 
 {% block extrajs %}
-{{form.media}}
 <script type="text/javascript">
 $(document).ready(function() {
     var printf = window.app.HAWCUtils.printf,
diff --git a/hawc/apps/animal/templates/animal/dosingregime_form.html b/hawc/apps/animal/templates/animal/dosingregime_form.html
index 394b753c98..be96a7e562 100644
--- a/hawc/apps/animal/templates/animal/dosingregime_form.html
+++ b/hawc/apps/animal/templates/animal/dosingregime_form.html
@@ -24,7 +24,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
       // reorganize forms
       var actions = $('.form-actions');
diff --git a/hawc/apps/animal/templates/animal/endpoint_copy_selector.html b/hawc/apps/animal/templates/animal/endpoint_copy_selector.html
index 16041f2874..0f4a8a2363 100644
--- a/hawc/apps/animal/templates/animal/endpoint_copy_selector.html
+++ b/hawc/apps/animal/templates/animal/endpoint_copy_selector.html
@@ -50,7 +50,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     let rerunSearch = function() {
         // rerun whenever settings change and an item isn't selected
diff --git a/hawc/apps/animal/templates/animal/endpoint_form.html b/hawc/apps/animal/templates/animal/endpoint_form.html
index 8f99d4071c..2bbcd69814 100644
--- a/hawc/apps/animal/templates/animal/endpoint_form.html
+++ b/hawc/apps/animal/templates/animal/endpoint_form.html
@@ -92,7 +92,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/json" id="config">
     {
       "vocabulary": {{vocabulary|safe}},
diff --git a/hawc/apps/animal/templates/animal/endpoint_list.html b/hawc/apps/animal/templates/animal/endpoint_list.html
index 4ef3cea49d..b21ea73755 100644
--- a/hawc/apps/animal/templates/animal/endpoint_list.html
+++ b/hawc/apps/animal/templates/animal/endpoint_list.html
@@ -22,7 +22,6 @@ <h2>Assessment endpoints ({{page_obj.paginator.count}} found)</h2>
 {% endblock content %}
 
 {% block extrajs %}
-    {{ form.media }}
     {{ config|json_script:"config" }}
     <script type="text/javascript">
         window.app.startup("animalStartup", function(animal){
diff --git a/hawc/apps/animal/templates/animal/experiment_copy_selector.html b/hawc/apps/animal/templates/animal/experiment_copy_selector.html
index da841cc1be..52905a3fec 100644
--- a/hawc/apps/animal/templates/animal/experiment_copy_selector.html
+++ b/hawc/apps/animal/templates/animal/experiment_copy_selector.html
@@ -14,7 +14,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/animal/templates/animal/experiment_form.html b/hawc/apps/animal/templates/animal/experiment_form.html
index 2757582bd5..d6a4e23ad9 100644
--- a/hawc/apps/animal/templates/animal/experiment_form.html
+++ b/hawc/apps/animal/templates/animal/experiment_form.html
@@ -8,7 +8,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
       $('#id_name').focus();
diff --git a/hawc/apps/assessment/templates/assessment/assessment_create_form.html b/hawc/apps/assessment/templates/assessment/assessment_create_form.html
index 32c35885fe..6f7066c448 100644
--- a/hawc/apps/assessment/templates/assessment/assessment_create_form.html
+++ b/hawc/apps/assessment/templates/assessment/assessment_create_form.html
@@ -12,6 +12,5 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   {% include 'assessment/_assessment_form_js.html' %}
 {% endblock extrajs %}
diff --git a/hawc/apps/assessment/templates/assessment/assessment_form.html b/hawc/apps/assessment/templates/assessment/assessment_form.html
index 6005d8c1ad..41bbe2452b 100644
--- a/hawc/apps/assessment/templates/assessment/assessment_form.html
+++ b/hawc/apps/assessment/templates/assessment/assessment_form.html
@@ -12,6 +12,5 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   {% include 'assessment/_assessment_form_js.html' %}
 {% endblock extrajs %}
diff --git a/hawc/apps/assessment/templates/assessment/assessment_log_list.html b/hawc/apps/assessment/templates/assessment/assessment_log_list.html
index 78645154a6..b2bd79f19e 100644
--- a/hawc/apps/assessment/templates/assessment/assessment_log_list.html
+++ b/hawc/apps/assessment/templates/assessment/assessment_log_list.html
@@ -87,7 +87,3 @@ <h2>{{assessment}} Logs</h2>
 {% include "includes/paginator.html" %}
 {% include 'assessment/_logs_note.html' %}
 {% endblock content %}
-
-{% block extrajs %}
-    {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/assessment/templates/assessment/dataset_form.html b/hawc/apps/assessment/templates/assessment/dataset_form.html
index 70d43fc579..9414e06322 100644
--- a/hawc/apps/assessment/templates/assessment/dataset_form.html
+++ b/hawc/apps/assessment/templates/assessment/dataset_form.html
@@ -7,7 +7,6 @@
 
 
 {% block extrajs %}
-{{ form.media }}
 <script type="text/javascript">
     $(document).ready(function () {
         $('#id_name').focus();
diff --git a/hawc/apps/assessment/templates/assessment/doseunits_form.html b/hawc/apps/assessment/templates/assessment/doseunits_form.html
index 9558c3444a..f881046a7d 100644
--- a/hawc/apps/assessment/templates/assessment/doseunits_form.html
+++ b/hawc/apps/assessment/templates/assessment/doseunits_form.html
@@ -6,7 +6,3 @@
 {% block content %}
   {% crispy form %}
 {% endblock content %}
-
-{% block extrajs %}
-  {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/assessment/templates/assessment/effecttag_form.html b/hawc/apps/assessment/templates/assessment/effecttag_form.html
index be45d8988f..b296097811 100644
--- a/hawc/apps/assessment/templates/assessment/effecttag_form.html
+++ b/hawc/apps/assessment/templates/assessment/effecttag_form.html
@@ -12,7 +12,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
       $('#id_name').on('keyup', function(){
diff --git a/hawc/apps/epi/templates/epi/adjustmentfactor_form.html b/hawc/apps/epi/templates/epi/adjustmentfactor_form.html
index 36e4b2d7f0..13196f6a95 100644
--- a/hawc/apps/epi/templates/epi/adjustmentfactor_form.html
+++ b/hawc/apps/epi/templates/epi/adjustmentfactor_form.html
@@ -11,6 +11,3 @@
   {% crispy form %}
 {% endblock content %}
 
-{% block extrajs %}
-  {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/epi/templates/epi/comparisonset_outcome_copy_selector.html b/hawc/apps/epi/templates/epi/comparisonset_outcome_copy_selector.html
index 01b6f85ac4..f73914641e 100644
--- a/hawc/apps/epi/templates/epi/comparisonset_outcome_copy_selector.html
+++ b/hawc/apps/epi/templates/epi/comparisonset_outcome_copy_selector.html
@@ -14,7 +14,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epi/templates/epi/comparisonset_sp_copy_selector.html b/hawc/apps/epi/templates/epi/comparisonset_sp_copy_selector.html
index 0153d34c22..f3dbc2130d 100644
--- a/hawc/apps/epi/templates/epi/comparisonset_sp_copy_selector.html
+++ b/hawc/apps/epi/templates/epi/comparisonset_sp_copy_selector.html
@@ -14,7 +14,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epi/templates/epi/criteria_form.html b/hawc/apps/epi/templates/epi/criteria_form.html
index 36e4b2d7f0..13196f6a95 100644
--- a/hawc/apps/epi/templates/epi/criteria_form.html
+++ b/hawc/apps/epi/templates/epi/criteria_form.html
@@ -11,6 +11,3 @@
   {% crispy form %}
 {% endblock content %}
 
-{% block extrajs %}
-  {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/epi/templates/epi/exposure_copy_selector.html b/hawc/apps/epi/templates/epi/exposure_copy_selector.html
index ee1bbc0afd..cc814c88ba 100644
--- a/hawc/apps/epi/templates/epi/exposure_copy_selector.html
+++ b/hawc/apps/epi/templates/epi/exposure_copy_selector.html
@@ -14,7 +14,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epi/templates/epi/exposure_form.html b/hawc/apps/epi/templates/epi/exposure_form.html
index 74cb2891b2..8144f9d780 100644
--- a/hawc/apps/epi/templates/epi/exposure_form.html
+++ b/hawc/apps/epi/templates/epi/exposure_form.html
@@ -21,8 +21,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
-
   <script type="text/javascript">
     $(document).on('ready', function () {
       new window.app.DynamicFormset($('#ctFormset'), 'form', { oneFormRequired: true });
diff --git a/hawc/apps/epi/templates/epi/outcome_copy_selector.html b/hawc/apps/epi/templates/epi/outcome_copy_selector.html
index 7c990daf34..de89918f63 100644
--- a/hawc/apps/epi/templates/epi/outcome_copy_selector.html
+++ b/hawc/apps/epi/templates/epi/outcome_copy_selector.html
@@ -12,7 +12,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epi/templates/epi/outcome_form.html b/hawc/apps/epi/templates/epi/outcome_form.html
index 529a85e120..7251204a72 100644
--- a/hawc/apps/epi/templates/epi/outcome_form.html
+++ b/hawc/apps/epi/templates/epi/outcome_form.html
@@ -10,7 +10,3 @@
 {% block content %}
   {% crispy form %}
 {% endblock %}
-
-{% block extrajs %}
-  {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/epi/templates/epi/outcome_list.html b/hawc/apps/epi/templates/epi/outcome_list.html
index 2a27315cb3..538c175d1c 100644
--- a/hawc/apps/epi/templates/epi/outcome_list.html
+++ b/hawc/apps/epi/templates/epi/outcome_list.html
@@ -22,7 +22,6 @@ <h2>Outcomes ({{page_obj.paginator.count}} found)</h2>
 {% endblock content %}
 
 {% block extrajs %}
-    {{ form.media }}
     {{ config|json_script:"config" }}
     <script type="text/javascript">
         window.app.startup("epiStartup", function(app){
diff --git a/hawc/apps/epi/templates/epi/result_copy_selector.html b/hawc/apps/epi/templates/epi/result_copy_selector.html
index a657cd5880..50288ee250 100644
--- a/hawc/apps/epi/templates/epi/result_copy_selector.html
+++ b/hawc/apps/epi/templates/epi/result_copy_selector.html
@@ -14,7 +14,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epi/templates/epi/result_form.html b/hawc/apps/epi/templates/epi/result_form.html
index d5558fe9df..57a7f4bfb6 100644
--- a/hawc/apps/epi/templates/epi/result_form.html
+++ b/hawc/apps/epi/templates/epi/result_form.html
@@ -25,7 +25,6 @@
 
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).on('ready', function(){
 
diff --git a/hawc/apps/epi/templates/epi/studypopulation_copy_selector.html b/hawc/apps/epi/templates/epi/studypopulation_copy_selector.html
index 42a0ddf748..a4e8777142 100644
--- a/hawc/apps/epi/templates/epi/studypopulation_copy_selector.html
+++ b/hawc/apps/epi/templates/epi/studypopulation_copy_selector.html
@@ -14,7 +14,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epi/templates/epi/studypopulation_form.html b/hawc/apps/epi/templates/epi/studypopulation_form.html
index 07c157e7d3..3f875e6cf3 100644
--- a/hawc/apps/epi/templates/epi/studypopulation_form.html
+++ b/hawc/apps/epi/templates/epi/studypopulation_form.html
@@ -12,7 +12,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epimeta/templates/epimeta/metaprotocol_form.html b/hawc/apps/epimeta/templates/epimeta/metaprotocol_form.html
index 609d8ae815..9f2d840466 100644
--- a/hawc/apps/epimeta/templates/epimeta/metaprotocol_form.html
+++ b/hawc/apps/epimeta/templates/epimeta/metaprotocol_form.html
@@ -12,7 +12,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
       var assessment = function(qry){qry.assessment = {{assessment.pk}};}
diff --git a/hawc/apps/epimeta/templates/epimeta/metaresult_copy_selector.html b/hawc/apps/epimeta/templates/epimeta/metaresult_copy_selector.html
index c54ec648b5..6aaacf95fc 100644
--- a/hawc/apps/epimeta/templates/epimeta/metaresult_copy_selector.html
+++ b/hawc/apps/epimeta/templates/epimeta/metaresult_copy_selector.html
@@ -12,7 +12,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
 
diff --git a/hawc/apps/epimeta/templates/epimeta/metaresult_form.html b/hawc/apps/epimeta/templates/epimeta/metaresult_form.html
index 7599e27085..ce26ab73a9 100644
--- a/hawc/apps/epimeta/templates/epimeta/metaresult_form.html
+++ b/hawc/apps/epimeta/templates/epimeta/metaresult_form.html
@@ -30,7 +30,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
       $("#srFormset").insertBefore($(".form-actions"));
diff --git a/hawc/apps/epimeta/templates/epimeta/metaresult_list.html b/hawc/apps/epimeta/templates/epimeta/metaresult_list.html
index dce65bfd64..a4eb9bf901 100644
--- a/hawc/apps/epimeta/templates/epimeta/metaresult_list.html
+++ b/hawc/apps/epimeta/templates/epimeta/metaresult_list.html
@@ -22,6 +22,5 @@ <h2>Meta-analysis/pooled results ({{page_obj.paginator.count}} found)</h2>
 {% endblock content %}
 
 {% block extrajs %}
-    {{ form.media }}
     {{ config|json_script:"config" }}
 {% endblock %}
diff --git a/hawc/apps/epiv2/templates/epiv2/design_form.html b/hawc/apps/epiv2/templates/epiv2/design_form.html
index e97e8ea338..e7b539b70a 100644
--- a/hawc/apps/epiv2/templates/epiv2/design_form.html
+++ b/hawc/apps/epiv2/templates/epiv2/design_form.html
@@ -12,7 +12,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $('.html5text').quillify();
     $("#id_study_design").focus();
diff --git a/hawc/apps/invitro/templates/invitro/ivcelltype_form.html b/hawc/apps/invitro/templates/invitro/ivcelltype_form.html
index 529a85e120..7251204a72 100644
--- a/hawc/apps/invitro/templates/invitro/ivcelltype_form.html
+++ b/hawc/apps/invitro/templates/invitro/ivcelltype_form.html
@@ -10,7 +10,3 @@
 {% block content %}
   {% crispy form %}
 {% endblock %}
-
-{% block extrajs %}
-  {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/invitro/templates/invitro/ivchemical_form.html b/hawc/apps/invitro/templates/invitro/ivchemical_form.html
index 06a0e41e4a..b208922f04 100644
--- a/hawc/apps/invitro/templates/invitro/ivchemical_form.html
+++ b/hawc/apps/invitro/templates/invitro/ivchemical_form.html
@@ -12,7 +12,7 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}<script type="text/javascript">
+  <script type="text/javascript">
     $(document).ready(function () {
 
       // handle all logic related to dtxid + cas
diff --git a/hawc/apps/invitro/templates/invitro/ivendpoint_form.html b/hawc/apps/invitro/templates/invitro/ivendpoint_form.html
index c4f55173ce..a4c12ddf3e 100644
--- a/hawc/apps/invitro/templates/invitro/ivendpoint_form.html
+++ b/hawc/apps/invitro/templates/invitro/ivendpoint_form.html
@@ -29,7 +29,6 @@
 {% endblock %}
 
 {% block extrajs %}
-{{ form.media }}
 <script type="text/javascript">
 
     var OELwidget = function($el){
diff --git a/hawc/apps/invitro/templates/invitro/ivendpoint_list.html b/hawc/apps/invitro/templates/invitro/ivendpoint_list.html
index ee210423b7..81a1cbef21 100644
--- a/hawc/apps/invitro/templates/invitro/ivendpoint_list.html
+++ b/hawc/apps/invitro/templates/invitro/ivendpoint_list.html
@@ -22,7 +22,6 @@ <h2><i>In vitro</i> endpoints ({{page_obj.paginator.count}} found)</h2>
 {% endblock content %}
 
 {% block extrajs %}
-    {{ form.media }}
     {{ config|json_script:"config" }}
     <script type="text/javascript">
         window.app.startup("invitroStartup", function(app){
diff --git a/hawc/apps/invitro/templates/invitro/ivexperiment_form.html b/hawc/apps/invitro/templates/invitro/ivexperiment_form.html
index 529a85e120..2dd31000bf 100644
--- a/hawc/apps/invitro/templates/invitro/ivexperiment_form.html
+++ b/hawc/apps/invitro/templates/invitro/ivexperiment_form.html
@@ -11,6 +11,3 @@
   {% crispy form %}
 {% endblock %}
 
-{% block extrajs %}
-  {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/lit/templates/lit/search_copy_selector.html b/hawc/apps/lit/templates/lit/search_copy_selector.html
index 5a1fd87e9e..d90d86384f 100644
--- a/hawc/apps/lit/templates/lit/search_copy_selector.html
+++ b/hawc/apps/lit/templates/lit/search_copy_selector.html
@@ -13,7 +13,6 @@
 {% endblock content %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
         var printf = window.app.HAWCUtils.printf,
diff --git a/hawc/apps/lit/templates/lit/search_form.html b/hawc/apps/lit/templates/lit/search_form.html
index 5b3e3b308c..838de645bf 100644
--- a/hawc/apps/lit/templates/lit/search_form.html
+++ b/hawc/apps/lit/templates/lit/search_form.html
@@ -7,7 +7,6 @@
 {% endblock %}
 
 {% block extrajs %}
-  {{ form.media }}
   <script type="text/javascript">
     $(document).ready(function(){
         $('#id_title').on('keyup', function () {
diff --git a/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html b/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
index 041c22d060..88a3d7e729 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/arob_text_form.html
@@ -6,6 +6,3 @@
     {% crispy form %}
 {% endblock %}
 
-{% block extrajs %}
-    {{ form.media }}
-{% endblock extrajs %}
diff --git a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
index f1b490f81a..cda2a180f0 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasdomain_form.html
@@ -7,7 +7,6 @@
 {% endblock %}
 
 {% block extrajs %}
-{{ form.media }}
 <script type="text/javascript">
 $(document).ready(function() {
     $('#id_name').focus();
diff --git a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
index b75835d6cf..6ae7d8a13f 100644
--- a/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
+++ b/hawc/apps/riskofbias/templates/riskofbias/riskofbiasmetric_form.html
@@ -66,7 +66,6 @@
 {% endblock %}
 
 {% block extrajs %}
-{{ form.media }}
 <script type="text/javascript">
 $(document).ready(function() {
     $('#detail_display').insertAfter($('#div_id_responses')).removeClass('hidden');
diff --git a/hawc/apps/study/templates/study/study_form.html b/hawc/apps/study/templates/study/study_form.html
index 547aa3d626..b3c0d65c83 100644
--- a/hawc/apps/study/templates/study/study_form.html
+++ b/hawc/apps/study/templates/study/study_form.html
@@ -7,7 +7,6 @@
 {% endblock %}
 
 {% block extrajs %}
-{{ form.media }}
 <script type="text/javascript">
 $(document).ready(function(){
     document.getElementById("id_short_citation").focus()
diff --git a/hawc/templates/base.html b/hawc/templates/base.html
index 8bbacdac52..d64d4d92f6 100644
--- a/hawc/templates/base.html
+++ b/hawc/templates/base.html
@@ -107,6 +107,9 @@
     <script type="text/javascript" src="{% static 'vendor/jqueryui/1.10.3/jquery-ui.min.js' %}"></script>
     <script type="text/javascript" src="{% static 'vendor/htmx/1.6.1/htmx.min.js' %}"></script>
     {% render_bundle 'main' %}
+    {% if form %}
+      {{ form.media }}
+    {% endif %}
     {% block extrajs %}{% endblock %}
   </body>
 </html>

From f8d1811d1a5d28636345d04d4f43fc4e62234e05 Mon Sep 17 00:00:00 2001
From: Daniel Rabstejnek <rabstejnek@gmail.com>
Date: Wed, 20 Jul 2022 12:52:48 -0400
Subject: [PATCH 09/14] Remove form media from automatically being added by
 crispy

---
 hawc/apps/common/forms.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hawc/apps/common/forms.py b/hawc/apps/common/forms.py
index 4ab5d16284..f0b89a506c 100644
--- a/hawc/apps/common/forms.py
+++ b/hawc/apps/common/forms.py
@@ -32,6 +32,7 @@ class BaseFormHelper(cf.FormHelper):
 
     error_text_inline = False
     use_custom_control = True
+    include_media = False
 
     def __init__(self, form=None, **kwargs):
         self.attrs = {}

From 70d36ebe48d5a3edba651398a5d37890fac696cb Mon Sep 17 00:00:00 2001
From: Andy Shapiro <shapiromatron@gmail.com>
Date: Thu, 1 Sep 2022 10:47:29 -0400
Subject: [PATCH 10/14] add doi.org; improve type checking

---
 hawc/apps/common/validators.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hawc/apps/common/validators.py b/hawc/apps/common/validators.py
index d79f080d9a..0d1123ec8c 100644
--- a/hawc/apps/common/validators.py
+++ b/hawc/apps/common/validators.py
@@ -1,5 +1,5 @@
 import re
-from typing import Sequence
+from typing import Optional, Sequence
 from urllib import parse
 
 import bleach
@@ -36,12 +36,13 @@
 valid_css_properties = {"color", "background-color"}
 valid_scheme = {"", "http", "https"}
 valid_netloc_endings = {
-    ".gov",
     ".edu",
+    ".gov",
     ".who.int",
-    "sciencedirect.com",
+    "doi.org",
     "elsevier.com",
     "public.tableau.com",
+    "sciencedirect.com",
 }
 
 
@@ -67,7 +68,7 @@ def clean_html(html: str) -> str:
     )
 
 
-def validate_html_tags(html: str, field: str = None) -> str:
+def validate_html_tags(html: str, field: Optional[str] = None) -> str:
     """Html contains a subset of acceptable tags.
 
     Args:

From d6dcc1ed9e271865640601610da61b4be85aa147 Mon Sep 17 00:00:00 2001
From: Andy Shapiro <shapiromatron@gmail.com>
Date: Thu, 1 Sep 2022 13:39:34 -0400
Subject: [PATCH 11/14] restore focus for object other than quill object

---
 frontend/shared/utils/Quillify.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/frontend/shared/utils/Quillify.js b/frontend/shared/utils/Quillify.js
index 7257bf1577..5f1f609aa9 100644
--- a/frontend/shared/utils/Quillify.js
+++ b/frontend/shared/utils/Quillify.js
@@ -61,10 +61,11 @@ const toolbarOptions = {
     };
 
 export default function() {
-    let modal = $("#smartTagModal"),
+    let focusedItem = $(":focus"),
+        modal = $("#smartTagModal"),
         showHawcTools = modal.length === 1;
 
-    return this.each(function() {
+    this.each(function() {
         let editor = document.createElement("div"),
             textarea = $(this),
             q;
@@ -98,4 +99,7 @@ export default function() {
             q.stc.enableModals();
         }
     });
+
+    // restore original focus
+    $(focusedItem).focus();
 }

From 7ba036252e14305df2a1775994fe6edc554b09a2 Mon Sep 17 00:00:00 2001
From: Andy Shapiro <shapiromatron@gmail.com>
Date: Thu, 1 Sep 2022 13:39:58 -0400
Subject: [PATCH 12/14] update epiv2 forms

---
 frontend/epiv2/form.js                                |  5 +----
 hawc/apps/epiv2/forms.py                              | 11 ++++++-----
 hawc/apps/epiv2/templates/epiv2/design_form.html      |  3 +--
 .../epiv2/templates/epiv2/fragments/_design_edit.html |  1 +
 4 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/frontend/epiv2/form.js b/frontend/epiv2/form.js
index 7c5e0e2c15..5c61a327a1 100644
--- a/frontend/epiv2/form.js
+++ b/frontend/epiv2/form.js
@@ -5,10 +5,7 @@ import {EXPOSURE_BIOMONITORING} from "./constants";
 
 const designFormStartup = function(form) {
         $(form)
-            .find(".html5text")
-            .quillify();
-        $(form)
-            .find("#id_study_design")
+            .find("#id_summary")
             .focus();
     },
     exposureFormStartup = function(form) {
diff --git a/hawc/apps/epiv2/forms.py b/hawc/apps/epiv2/forms.py
index 671b7b2488..af61e8bde3 100644
--- a/hawc/apps/epiv2/forms.py
+++ b/hawc/apps/epiv2/forms.py
@@ -5,7 +5,7 @@
 
 from ..assessment.lookups import DssToxIdLookup
 from ..common import selectable
-from ..common.forms import ArrayCheckboxSelectMultiple
+from ..common.forms import ArrayCheckboxSelectMultiple, QuillField
 from ..common.widgets import SelectMultipleOtherWidget, SelectOtherWidget
 from . import constants, lookups, models
 
@@ -23,6 +23,11 @@ class Meta:
         model = models.Design
         exclude = ("study",)
         widgets = {"age_profile": ArrayCheckboxSelectMultiple(choices=constants.AgeProfile.choices)}
+        field_classes = {
+            "criteria": QuillField,
+            "susceptibility": QuillField,
+            "comments": QuillField,
+        }
 
     def __init__(self, *args, **kwargs):
         study = kwargs.pop("parent", None)
@@ -32,10 +37,6 @@ def __init__(self, *args, **kwargs):
 
     @property
     def helper(self):
-        for fld in ("criteria", "susceptibility", "comments"):
-            self.fields[fld].widget.attrs["class"] = "html5text"
-            self.fields[fld].widget.attrs["rows"] = 3
-
         if self.instance.id:
             helper = BaseFormHelper(self)
             helper.form_tag = False
diff --git a/hawc/apps/epiv2/templates/epiv2/design_form.html b/hawc/apps/epiv2/templates/epiv2/design_form.html
index b948927bd4..7a00cae709 100644
--- a/hawc/apps/epiv2/templates/epiv2/design_form.html
+++ b/hawc/apps/epiv2/templates/epiv2/design_form.html
@@ -16,7 +16,6 @@
 
 {% block extrajs %}
   <script type="text/javascript">
-    $('.html5text').quillify();
-    $("#id_study_design").focus();
+    $("#id_summary").focus();
   </script>
 {% endblock extrajs %}
diff --git a/hawc/apps/epiv2/templates/epiv2/fragments/_design_edit.html b/hawc/apps/epiv2/templates/epiv2/fragments/_design_edit.html
index 19ad667fd0..98c28ae0f2 100644
--- a/hawc/apps/epiv2/templates/epiv2/fragments/_design_edit.html
+++ b/hawc/apps/epiv2/templates/epiv2/fragments/_design_edit.html
@@ -15,4 +15,5 @@
       </div>
     </div>
   </form>
+  {{form.media}}
 </div>

From d177f34d9c85ba1ff4acd35eae8b0106d84ebde5 Mon Sep 17 00:00:00 2001
From: Andy Shapiro <shapiromatron@gmail.com>
Date: Thu, 1 Sep 2022 13:50:45 -0400
Subject: [PATCH 13/14] update tests

---
 tests/hawc/apps/common/test_forms.py | 49 ++++++++++++++--------------
 1 file changed, 24 insertions(+), 25 deletions(-)

diff --git a/tests/hawc/apps/common/test_forms.py b/tests/hawc/apps/common/test_forms.py
index 0f9444c297..351da87c3f 100644
--- a/tests/hawc/apps/common/test_forms.py
+++ b/tests/hawc/apps/common/test_forms.py
@@ -8,34 +8,33 @@ class TestQuillField:
     def test_validate(self):
         fld = QuillField()
 
-        # invalid scheme
-        html = '<a href="ftp://www.example.gov">link</a>'
-        with pytest.raises(ValidationError):
-            fld.validate(html)
-
-        # invalid TLD
-        html = '<a href="http://www.example.com">link</a>'
-        with pytest.raises(ValidationError):
-            fld.validate(html)
-
         # valid
         html = '<a href="http://www.example.gov">link</a>'
         fld.validate(html)
 
+        # invalid
+        for html in [
+            '<a href="ftp://www.example.gov">link</a>',  # schema
+            '<a href="http://www.example.com">link</a>',  # tld
+        ]:
+            with pytest.raises(ValidationError):
+                fld.validate(html)
+
     def test_to_python(self):
         fld = QuillField()
-
-        # tags should be cleaned
-        html = "<script>alert();</script>"
-        cleaned_html = fld.to_python(html)
-        assert cleaned_html == "alert();"
-
-        # attrs should be cleaned
-        html = '<a href="www.example.com" title="title">link</a>'
-        cleaned_html = fld.to_python(html)
-        assert cleaned_html == '<a href="www.example.com">link</a>'
-
-        # styles should be cleaned
-        html = '<span style="color:blue;display:none">test</span>'
-        cleaned_html = fld.to_python(html)
-        assert cleaned_html == '<span style="color:blue;">test</span>'
+        data = [
+            # remove script tag
+            ("<script>alert();</script>", "alert();"),
+            # remove attribute
+            (
+                '<a href="www.example.com" title="title">link</a>',
+                '<a href="www.example.com">link</a>',
+            ),
+            # remove some styles
+            (
+                '<span style="color:blue;display:none">test</span>',
+                '<span style="color:blue;">test</span>',
+            ),
+        ]
+        for input_html, output_html in data:
+            assert fld.to_python(input_html) == output_html

From 75427b9c7bd5fe884dc1589440c6029851e7761e Mon Sep 17 00:00:00 2001
From: Andy Shapiro <shapiromatron@gmail.com>
Date: Thu, 1 Sep 2022 15:49:34 -0400
Subject: [PATCH 14/14] fix edit row

---
 .../templates/assessment/fragments/attachment_edit_row.html      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hawc/apps/assessment/templates/assessment/fragments/attachment_edit_row.html b/hawc/apps/assessment/templates/assessment/fragments/attachment_edit_row.html
index 469f29c816..5c3187ac73 100644
--- a/hawc/apps/assessment/templates/assessment/fragments/attachment_edit_row.html
+++ b/hawc/apps/assessment/templates/assessment/fragments/attachment_edit_row.html
@@ -32,5 +32,6 @@
             </div>
         </form>
     </td>
+    {{ form.media }}
     {% endif %}
 </tr>