from django.utils.translation import ugettext_lazy as _
from fluent_contents.extensions import ContentPlugin, plugin_pool
from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
from fluent_contents.plugins.oembeditem.models import OEmbedItem


@plugin_pool.register
class OEmbedPlugin(ContentPlugin):
    model = OEmbedItem
    category = _('Online content')
    form = OEmbedItemForm
    render_template = "fluent_contents/plugins/oembed/default.html"

    class Media:
        css = {
            'screen': (
                'fluent_contents/plugins/oembed/oembed_admin.css',
            )
        }


    def get_render_template(self, request, instance, **kwargs):
        """
        Allow to style the item based on the type.
        """
        return ["fluent_contents/plugins/oembed/{type}.html".format(type=instance.type or 'default'), self.render_template]

from django.utils.translation import ugettext_lazy as _
from fluent_contents.extensions import ContentPlugin, plugin_pool
from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
from fluent_contents.plugins.oembeditem.models import OEmbedItem
import re

re_safe = re.compile(r'[^\w_-]')


@plugin_pool.register
class OEmbedPlugin(ContentPlugin):
    model = OEmbedItem
    category = _('Online content')
    form = OEmbedItemForm
    render_template = "fluent_contents/plugins/oembed/default.html"

    class Media:
        css = {
            'screen': (
                'fluent_contents/plugins/oembed/oembed_admin.css',
            )
        }


    def get_render_template(self, request, instance, **kwargs):
        """
        Allow to style the item based on the type.
        """
        safe_filename = re_safe.sub('', instance.type or 'default')
        return [
            "fluent_contents/plugins/oembed/{type}.html".format(type=safe_filename),
            self.render_template
        ]

Make sure the OEmbed type can never be used to control filenames.
Make sure the OEmbed type can never be used to control filenames.

Minor risk, as it's still a template path, but better be safe then sorry.

  from django.utils.translation import ugettext_lazy as _
  from fluent_contents.extensions import ContentPlugin, plugin_pool
  from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
  from fluent_contents.plugins.oembeditem.models import OEmbedItem
+ import re
+ 
+ re_safe = re.compile(r'[^\w_-]')
  
  
  @plugin_pool.register
  class OEmbedPlugin(ContentPlugin):
      model = OEmbedItem
      category = _('Online content')
      form = OEmbedItemForm
      render_template = "fluent_contents/plugins/oembed/default.html"
  
      class Media:
          css = {
              'screen': (
                  'fluent_contents/plugins/oembed/oembed_admin.css',
              )
          }
  
  
      def get_render_template(self, request, instance, **kwargs):
          """
          Allow to style the item based on the type.
          """
-         return ["fluent_contents/plugins/oembed/{type}.html".format(type=instance.type or 'default'), self.render_template]
+         safe_filename = re_safe.sub('', instance.type or 'default')
+         return [
+             "fluent_contents/plugins/oembed/{type}.html".format(type=safe_filename),
+             self.render_template
+         ]
  
Make sure the OEmbed type can never be used to control filenames.
## Code Before:
from django.utils.translation import ugettext_lazy as _
from fluent_contents.extensions import ContentPlugin, plugin_pool
from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
from fluent_contents.plugins.oembeditem.models import OEmbedItem


@plugin_pool.register
class OEmbedPlugin(ContentPlugin):
    model = OEmbedItem
    category = _('Online content')
    form = OEmbedItemForm
    render_template = "fluent_contents/plugins/oembed/default.html"

    class Media:
        css = {
            'screen': (
                'fluent_contents/plugins/oembed/oembed_admin.css',
            )
        }


    def get_render_template(self, request, instance, **kwargs):
        """
        Allow to style the item based on the type.
        """
        return ["fluent_contents/plugins/oembed/{type}.html".format(type=instance.type or 'default'), self.render_template]

## Instruction:
Make sure the OEmbed type can never be used to control filenames.
## Code After:
from django.utils.translation import ugettext_lazy as _
from fluent_contents.extensions import ContentPlugin, plugin_pool
from fluent_contents.plugins.oembeditem.forms import OEmbedItemForm
from fluent_contents.plugins.oembeditem.models import OEmbedItem
import re

re_safe = re.compile(r'[^\w_-]')


@plugin_pool.register
class OEmbedPlugin(ContentPlugin):
    model = OEmbedItem
    category = _('Online content')
    form = OEmbedItemForm
    render_template = "fluent_contents/plugins/oembed/default.html"

    class Media:
        css = {
            'screen': (
                'fluent_contents/plugins/oembed/oembed_admin.css',
            )
        }


    def get_render_template(self, request, instance, **kwargs):
        """
        Allow to style the item based on the type.
        """
        safe_filename = re_safe.sub('', instance.type or 'default')
        return [
            "fluent_contents/plugins/oembed/{type}.html".format(type=safe_filename),
            self.render_template
        ]
