"""
Definition of the plugin.
"""
from django.utils.translation import ugettext_lazy as _
from fluent_contents.extensions import ContentPlugin, plugin_pool
from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
from fluent_contents.plugins.oembeditem.models import OEmbedItem


@plugin_pool.register
class OEmbedPlugin(ContentPlugin):
    model = OEmbedItem
    category = _('Online content')
    form = OEmbedItemForm
    render_template = "fluent_contents/plugins/oembed/default.html"

    class Media:
        css = {
            'screen': (
                'fluent_contents/plugins/oembed/oembed_admin.css',
            )
        }


    def get_render_template(self, request, instance, **kwargs):
        """
        Allow to style the item based on the type.
        """
        return ["fluent_contents/plugins/oembed/{type}.html".format(type=instance.type or 'default'), self.render_template]

"""
Definition of the plugin.
"""
from django.utils.translation import ugettext_lazy as _
from fluent_contents.extensions import ContentPlugin, plugin_pool
from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
from fluent_contents.plugins.oembeditem.models import OEmbedItem
import re

re_safe = re.compile(r'[^\w_-]')


@plugin_pool.register
class OEmbedPlugin(ContentPlugin):
    model = OEmbedItem
    category = _('Online content')
    form = OEmbedItemForm
    render_template = "fluent_contents/plugins/oembed/default.html"

    class Media:
        css = {
            'screen': (
                'fluent_contents/plugins/oembed/oembed_admin.css',
            )
        }


    def get_render_template(self, request, instance, **kwargs):
        """
        Allow to style the item based on the type.
        """
        safe_filename = re_safe.sub('', instance.type or 'default')
        return [
            "fluent_contents/plugins/oembed/{type}.html".format(type=safe_filename),
            self.render_template
        ]

Make sure the OEmbed type can never be used to control filenames.
Make sure the OEmbed type can never be used to control filenames.

Minor risk, as it's still a template path, but better be safe then sorry.
