Merge branch 'develop'

frappe/__version__.py

@@ -1,2 +1,2 @@
 from __future__ import unicode_literals
-__version__ = "6.24.2"
+__version__ = "6.24.3"

frappe/hooks.py

@@ -5,7 +5,7 @@ app_publisher = "Frappe Technologies"
 app_description = "Full stack web framework with Python, Javascript, MariaDB, Redis, Node"
 
 app_icon = "octicon octicon-circuit-board"
-app_version = "6.24.2"
+app_version = "6.24.3"
 app_color = "orange"
 source_link = "https://github.com/frappe/frappe"
 app_license = "MIT"

frappe/utils/__init__.py

@@ -410,9 +410,12 @@ def sanitize_html(html):
 	elif is_json(html):
 		return html
 
+	whitelisted_tags = (HTMLSanitizer.acceptable_elements + HTMLSanitizer.svg_elements
+		+ ["html", "head", "meta", "link", "body", "iframe", "style", "o:p"])
+
 	# retuns html with escaped tags, escaped orphan >, <, etc.
 	escaped_html = bleach.clean(html,
-		tags=HTMLSanitizer.acceptable_elements + HTMLSanitizer.svg_elements + ["iframe"],
+		tags=whitelisted_tags,
 		attributes={"*": HTMLSanitizer.acceptable_attributes, "svg": HTMLSanitizer.svg_attributes},
 		styles=bleach_whitelist.all_styles,
 		strip_comments=False)

setup.py

@@ -1,7 +1,7 @@
 from setuptools import setup, find_packages
 from pip.req import parse_requirements
 
-version = "6.24.2"
+version = "6.24.3"
 requirements = parse_requirements("requirements.txt", session="")
 
 setup(