Jul 24 - Update Rich-text editor to enhance table editor

README.md

@@ -183,16 +183,18 @@ Then visit `https://your-domain/admin`, sign in, and manage content.
   change, newest first, filterable by action and type, paginated 50/page. Times
   are UTC.
 
-The editor (Quill 2) and drag library (SortableJS) are **vendored locally** under
-`static/vendor/` — no CDN dependency, so they work on a locked-down server and
-survive a strict CSP. The body toolbar supports **inline images** and **tables**
-(Quill 2's built-in table module: insert, add/remove rows & columns). Images are
+The editor (Quill 2 + quill-table-better) and drag library (SortableJS) are
+**vendored locally** under `static/vendor/` — no CDN dependency, so they work on a
+locked-down server and survive a strict CSP. The body toolbar supports **inline
+images** and **tables** with **drag-to-resize columns/rows** and a floating cell
+menu for **alignment, borders and background** (merge/split too). Images are
 uploaded via `POST /admin/upload` — the file is stored under `static/uploads/`
 and referenced by URL, so the database stays small (no base64). Rich-text HTML is
-sanitized on save (`bleach`) against a tag allowlist that now includes `img` and
-table tags, so a paste can't inject markup, `javascript:`, or `data:` URLs into
-the public page. If the editor ever fails to load, the body field degrades to a
-plain textarea — a save never wipes content.
+sanitized on save (`bleach` + `tinycss2` CSS sanitizer): a tag allowlist covers
+images and tables, and inline `style` is filtered to a small CSS-property allowlist
+(width/alignment/border/background) so a paste can't inject markup, `javascript:`,
+`data:`, or dangerous CSS into the public page. If the editor ever fails to load,
+the body field degrades to a plain textarea — a save never wipes content.
 
 `static/uploads/` must be writable by the app user (`jqc`) in production:
 `sudo -u jqc mkdir -p static/uploads`. Uploaded files are gitignored.