8 功能6：后台管理页面，编辑文章,xss攻击

<script>
    KindEditor.ready(function (K) {
        window.editor = K.create('#editor_id', {
             "800",
            height: "600",
            items: ['source', '|', 'undo', 'redo', '|', 'preview', 'print', 'template', 'code', 'cut', 'copy', 'paste',
                'plainpaste', 'wordpaste', '|', 'justifyleft', 'justifycenter', 'justifyright',
                'justifyfull', 'insertorderedlist', 'insertunorderedlist', 'indent', 'outdent', 'subscript',
                'superscript', 'clearhtml', 'quickformat', 'selectall', '|', 'fullscreen', '/',
                'formatblock', 'fontname', 'fontsize'
                ],
            resizeType:1
        });
    });
</script>

   # 富文本编辑框 图片上传
    re_path(r'^upload/$', views.upload, name='upload'),

def upload(request):
    """上传文件"""
    print(request.FILES)

    # 获取文件name
    img = request.FILES.get("upload_img")
    print(img.name)

    # 文件存取路径
    import os
    from cnblog import settings
    img_path = os.path.join(settings.MEDIA_ROOT, "add_article_img", img.name)

    # 图片读取，写入到服务端
    with open(img_path, "wb") as f:
        for line in img:
            f.write(line)


    # 文件预览功能
    response = {
        "error":0,
        "url":"/media/add_article_img/%s" % img.name
    }
    import json
    return HttpResponse(json.dumps(response))

                              <div class="content form-group">
                                    <label for="">内容(Kindeditor编辑器，不支持拖放/粘贴上传图片) </label>
                                    <div>
                                        <textarea id="editor_id" name="content"
                                                  style="700px;height:300px;"></textarea>
                                    </div>
                                </div>

<script charset="utf-8" src="/static/kindeditor/kindeditor-all-min.js"></script>
<script src="/static/js/jquery-3.2.1.min.js"></script>
<script>
    KindEditor.ready(function (K) {
        window.editor = K.create('#editor_id', {
             "800",
            height: "600",
            
            //  自定制
            items: ['source', '|', 'undo', 'redo', '|', 'preview', 'print', 'template', 'code', 'cut', 'copy', 'paste',
                'plainpaste', 'wordpaste', '|', 'justifyleft', 'justifycenter', 'justifyright',
                'justifyfull', 'insertorderedlist', 'insertunorderedlist', 'indent', 'outdent', 'subscript',
                'superscript', 'clearhtml', 'quickformat', 'selectall', '|', 'fullscreen', '/',
                'formatblock', 'fontname', 'fontsize', '|', 'forecolor', 'hilitecolor', 'bold',
                'italic', 'underline', 'strikethrough', 'lineheight', 'removeformat', '|', 'image', 'multiimage',
                'flash', 'media', 'insertfile', 'table', 'hr', 'emoticons', 'baidumap', 'pagebreak',
                'anchor', 'link', 'unlink', '|', 'about'
            ],
            
            // textarea可以拉伸
            resizeType: 1,
            
            //文件上传的处理视图
            uploadJson: "/upload/",
            
            //文件上传的参数
            extraFileUploadParams: {
                "csrfmiddlewaretoken": $("[name='csrfmiddlewaretoken']").val(),
            },
            
            // 文件上传的name
            filePostName:"upload_img",      

        });
    });
</script>

from bs4 import BeautifulSoup

s = "<h1>hello</h1> <span>world</sapn> <script>alert(1111)</script>"

soup = BeautifulSoup(s, "html.parser")      # 按照html格式过滤

print(soup.text)        # 过滤掉标签，只剩下text文本

print(soup.find_all())  # 按标签进行截断

for tag in soup.find_all():
    print(tag.name)     # 打印标签的name

    if tag.name == "script":
        tag.decompose()     # Recursively destroys the contents of this tree.

print(str(soup))

@login_required
def add_article(request):

    if request.method == "POST":
        title = request.POST.get('title')
        content = request.POST.get('content')

        # 过滤
        from bs4 import BeautifulSoup
        soup = BeautifulSoup(content,  "html.parser")
        for tag in soup.find_all():
            if tag.name == "script":
                tag.decompose()


        # 获取文本，进行截取，赋值给desc
        desc = soup.text[0:150]

        models.Article.objects.create(title=title,content=str(soup),desc=desc, user=request.user)
        return redirect("/cn_backend/")
    return render(request, "backend/add_article.html", locals())