Prevent user from entering HTML through the forms

.gitignore

@@ -22,6 +22,10 @@ develop-eggs
 .installed.cfg
 lib
 lib64
+env
+.env
+venv
+.venv
 
 # Installer logs
 pip-log.txt

djangocms_forms/forms.py

@@ -13,6 +13,7 @@
 from django.template.loader import get_template, render_to_string
 from django.utils.translation import ugettext_lazy as _
 
+from django_bleach.forms import BleachField
 from ipware.ip import get_ip
 from unidecode import unidecode
 
@@ -154,7 +155,7 @@ def prepare_text(self, field):
         field_attrs.update({
             'widget': forms.TextInput(attrs=widget_attrs)
         })
-        return forms.CharField(**field_attrs)
+        return BleachField(**field_attrs)
 
     def prepare_textarea(self, field):
         field_attrs = field.build_field_attrs()
@@ -163,7 +164,7 @@ def prepare_textarea(self, field):
         field_attrs.update({
             'widget': forms.Textarea(attrs=widget_attrs)
         })
-        return forms.CharField(**field_attrs)
+        return BleachField(**field_attrs)
 
     def prepare_email(self, field):
         field_attrs = field.build_field_attrs()
@@ -271,7 +272,7 @@ def prepare_hidden(self, field):
         field_attrs.update({
             'widget': forms.HiddenInput(attrs=widget_attrs),
         })
-        return forms.CharField(**field_attrs)
+        return BleachField(**field_attrs)
 
     def prepare_number(self, field):
         field_attrs = field.build_field_attrs()
@@ -298,7 +299,7 @@ def prepare_password(self, field):
         field_attrs.update({
             'widget': forms.PasswordInput(attrs=widget_attrs),
         })
-        return forms.CharField(**field_attrs)
+        return BleachField(**field_attrs)
 
     def prepare_phone(self, field):
         field_attrs = field.build_field_attrs()
@@ -307,7 +308,7 @@ def prepare_phone(self, field):
         field_attrs.update({
             'widget': TelephoneInput(attrs=widget_attrs),
         })
-        return forms.CharField(**field_attrs)
+        return BleachField(**field_attrs)
 
     def save(self, request):
         form_data = []

setup.py

@@ -36,6 +36,7 @@
     include_package_data=True,
     install_requires=[
         'django-appconf',
+        'django-bleach>=0.4.0',
         'django-ipware',
         'jsonfield',
         'unidecode',