membershipworks: Use nh3 to unescape event titles

membershipworks/admin.py

@@ -123,7 +123,7 @@ class EventInstructorAdmin(admin.ModelAdmin):
 class EventAdmin(DjangoObjectActions, admin.ModelAdmin):
     inlines = [EventMeetingTimeInline]
     list_display = [
-        "title",
+        "unescaped_title",
         "start",
         "duration",
         "count",
@@ -158,6 +158,10 @@ class EventAdmin(DjangoObjectActions, admin.ModelAdmin):
         fields.append("_details_timestamp")
         return fields
 
+    @admin.display(ordering="title")
+    def unescaped_title(self, obj):
+        return obj.unescaped_title
+
     @admin.display(ordering="duration")
     def duration(self, obj):
         return obj.duration

membershipworks/models.py

@@ -21,6 +21,7 @@ from django.db.models import (
 from django.db.models.functions import Coalesce
 from django.utils import timezone
 
+import nh3
 from django_db_views.db_view import DBView
 
 
@@ -425,8 +426,12 @@ class Event(BaseModel):
 
     _allowed_missing_fields = ["cap", "edp", "adn"]
 
+    @property
+    def unescaped_title(self):
+        return nh3.clean(self.title, tags=set())
+
     def __str__(self):
-        return self.title
+        return self.unescaped_title
 
 
 class EventInstructor(models.Model):

membershipworks/views.py

@@ -139,6 +139,7 @@ class EventTable(tables.Table):
             '<a title="Admin" href="{% url "admin:membershipworks_eventext_change" record.pk %}"><i class="bi bi-pencil-square"></i></a> '
             '<a title="Invoice" href="{% url "membershipworks:event-invoice" record.pk %}"><i class="bi bi-receipt"></i></a> '
         ),
+        accessor="unescaped_title",
     )
     occurred = tables.BooleanColumn(visible=False)
     start = tables.DateColumn("N d, Y")