module.exports = { projection: { title: 1, _url: 1, attachment: 1 }, //sanitizeHtml: { // allowedTags: [], // allowedAttributes: {}, // allowedClasses: {} //} sanitizeHtml: { allowedTags: [ 'h2', 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div', 'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'sup', 'sub', 'span' ], allowedClasses: { 'p': ['highlighted', 'indent', 'bulletLevel2','apos-indent1', 'apos-indent2'], 'ul': ['bulletLevel2','apos-indent1', 'apos-indent2'], 'div': ['highlighted', "bulletLevel2",'apos-indent1', 'apos-indent2', 'date'], '*': ['highlighted', 'bulletLevel2', 'test', '*','apos-indent1', 'apos-indent2'] }, allowedAttributes: { '*': ['style', 'class'], ul: ['class', 'style'], p: ['class', 'style'], div: ['class', 'style'], a: [ 'href', 'name', 'target', 'class', 'style'], // We don't currently allow img itself by default, but this // would make sense if we did img: [ 'src' ] }, //allowedAttributes: {}, //allowedTags: false, //allowedAttributes: false, //allowedClasses: false, // Lots of these won't come up by default because we don't allow them selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ], // URL schemes we permit allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ], allowedSchemesByTag: {} } }