Fix script injection using markdown

[cheatdb.git] / app / __init__.py

diff --git a/app/__init__.py b/app/__init__.py
index 1031c930bb507c612975c55f3c233df2aec2b731..b5aa36c9a57fc0c13e9dffe2d8460e2ab743d6c4 100644 (file)
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -3,12 +3,13 @@ from flask_user import *
 import flask_menu as menu
 from flask.ext import markdown
 from flask_github import GitHub
+import os
 
 app = Flask(__name__)
-app.config.from_pyfile("../config.cfg")
+app.config.from_pyfile(os.environ["FLASK_CONFIG"])
 
 menu.Menu(app=app)
-markdown.Markdown(app, extensions=["fenced_code"])
+markdown.Markdown(app, extensions=["fenced_code"], safe_mode=True, output_format="html5")
 github = GitHub(app)
 
 from . import models