Jul 24 - Update Rich-text editor to support uploading images and inserting table

app.py

@@ -91,14 +91,28 @@ def log_action(actor, action, entity, entity_id=None, detail=None):
 ALLOWED_TAGS = [
     "p", "br", "strong", "b", "em", "i", "u", "s", "strike",
     "ul", "ol", "li", "a", "h2", "h3", "blockquote",
+    # images (inserted via the /admin/upload endpoint or a URL)
+    "img",
+    # tables (Quill 2 built-in table module)
+    "table", "thead", "tbody", "tr", "td", "th", "col", "colgroup",
 ]
-ALLOWED_ATTRS = {"a": ["href", "title", "target", "rel"]}
+ALLOWED_ATTRS = {
+    "a": ["href", "title", "target", "rel"],
+    "img": ["src", "alt", "width", "height"],
+    # Quill 2 tags cells/rows with data-row; keep the standard span attrs too.
+    "table": ["class"],
+    "td": ["data-row", "colspan", "rowspan"],
+    "th": ["data-row", "colspan", "rowspan"],
+    "tr": ["data-row"],
+    "col": ["width"],
+}
 
 
 def sanitize_html(raw):
     """Clean editor HTML against the allowlist. Returns None for empty content
-    so blank bodies stay NULL. bleach also restricts link protocols to
-    http/https/mailto, blocking javascript: URLs."""
+    so blank bodies stay NULL. bleach also restricts URL protocols to
+    http/https/mailto for both links and images, blocking javascript: and
+    data: URLs (uploaded images are served from a relative /static path)."""
     if not raw:
         return None
     cleaned = bleach.clean(