Sanitize input from rich text widget

[nidico]

Former title:

elements can break tinymce editor

You can shoot yourself in the foot by adding a <form> element to a document (e.g. through the tinymce source editor).

This breaks the wysiwyg editor, as it simply renders the document's html and erroneously closes the outer form, which makes the save/abort buttons not work anymore.

I'm not sure how this should best be dealt with - I guess the HTML source should be sanitized, e.g. <form> elements be removed.

[dnouri]

Yes, agree that input needs to be sanitized.

[dnouri]

I just did this in a project of mine. lxml.html.clean.clean_html seems to do a pretty good job. Just a matter of hooking this in.