A few weeks ago, CVE-2019-11324 was opened on urllib versions 1.24.1 and earlier. Please bump this dependency to 1.24.2 to patch the CVE.

Just curious, what does this change?

I don't know if this is standard or not, but I prefer to put variables outside of a method after import statements at the top of the module. Since these are used for configuration, it would help to group all related configuration values at the top of the file for easier reading. You could group it with the PROJECT_DIR variable on line 12.

Hi @shraddhaag, nice work! :thumbsup: It's super exciting to see the WYSIWYG editor!

I left some feedback in-line, but I have a few other comments:

1. Happiness Archive does not display rich text formatting
2. Editor window should fit user's screen size (not sure about mobile devices?)
3. Embedded images should always adjust for the user's screen size in email and Happiness Archive / confirmation screen

Screenshot examples of each are below:

Comment 1: Happiness Archive does not render rich-text formatting:

Comment 2: Editor window goes off-screen when sending a new Happiness Packet:

Do you think you can figure these out? If we can make these improvements, the PR is ready to go. :grinning:

@jflory7 I integrated all the changes. Please let me know if I need to change anything else :)

Just curious, what does this change?

By default HTML is not escaped and so is displayed as text. We need to mark the field as safe so that Django renders it as HTML. It's detailed here in the documentation.

@shraddhaag It's generally not advisable to mark text as safe in Django if it is coming from a user input.

YOu can

From a security standpoint, a user can inject <script> elements into the input and this can lead to Cross Side Scripting

AFAIK, Django does not have any method by which you can render HTML and protect XSS.

You might be interested in Mozilla Bleach for this

Hi @skamath! I've updated the PR with your suggestions. Please let me know if I need to make anymore changes :)

I re-tested and everything looks good. :thumbsup: I think this is ready to go, but I'll let @skamath give a final review + merge.

@shraddhaag Excellent work!! :100: :100:

This PR LGTM, however I am unable to merge this. Maybe a permission issue.

@skamath Oops, your ACL's weren't updated. They are now. :smile:

I'm going to go ahead and merge this. Thanks @shraddhaag! :clapper: