feat: allow for a subset of markdown (bold, italics, strikethrough, links) when displaying notes

app/apps/common/templatetags/markdown.py

@@ -0,0 +1,52 @@
+from typing import Optional
+
+import mistune
+from django import template
+from django.utils.safestring import mark_safe
+from mistune import HTMLRenderer, Markdown, BlockParser, InlineParser, safe_entity
+from mistune.plugins.formatting import strikethrough as plugin_strikethrough
+from mistune.plugins.url import url as plugin_url
+
+
+register = template.Library()
+
+
+class CustomRenderer(HTMLRenderer):
+    def link(self, text: str, url: str, title: Optional[str] = None) -> str:
+        s = '<a rel="nofollow" target="_blank" href="' + self.safe_url(url) + '"'
+        if title:
+            s += ' title="' + safe_entity(title) + '"'
+        return s + ">" + text + "</a>"
+
+    def paragraph(self, text: str) -> str:
+        return text + "\n"
+
+    def softbreak(self) -> str:
+        return "\n"
+
+    def blank_line(self) -> str:
+        return "\n"
+
+
+block = BlockParser()
+block.rules = ["blank_line"]
+inline = InlineParser(hard_wrap=False)
+inline.rules = [
+    "emphasis",
+    "link",
+    "auto_link",
+    "auto_email",
+    "linebreak",
+    "softbreak",
+]
+markdown = Markdown(
+    renderer=CustomRenderer(escape=False),
+    block=block,
+    inline=inline,
+    plugins=[plugin_strikethrough, plugin_url],
+)
+
+
+@register.filter(name="limited_markdown")
+def limited_markdown(value):
+    return mark_safe(markdown(value))

app/templates/cotton/transaction/item.html

@@ -1,3 +1,4 @@
+{% load markdown %}
 {% load i18n %}
 <div class="transaction d-flex my-1 {% if transaction.type == "EX" %}expense{% else %}income{% endif %}">
   {% if not disable_selection %}
@@ -54,7 +55,7 @@
         {% if transaction.notes %}
         <div class="row mb-2 mb-lg-1 tw-text-gray-400">
           <div class="col-auto pe-1"><i class="fa-solid fa-align-left fa-fw me-1 fa-xs"></i></div>
-          <div class="col ps-0">{{ transaction.notes | linebreaksbr }}</div>
+          <div class="col ps-0">{{ transaction.notes | limited_markdown | linebreaksbr }}</div>
         </div>
         {% endif %}
 {#        Category#}

requirements.txt

@@ -26,3 +26,4 @@ python-dateutil~=2.9.0.post0
 simpleeval~=1.0.0
 pydantic~=2.10.5
 PyYAML~=6.0.2
+mistune~=3.1.1