From db4fd9f60c5e9a31de3733190e671ee9b334e91b Mon Sep 17 00:00:00 2001
From: dwindown <dwinx.ramz@gmail.com>
Date: Tue, 28 Apr 2026 19:44:28 +0700
Subject: [PATCH] Render basis stem preview as plain text instead of raw HTML

---
 app/admin_web.py | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/admin_web.py b/app/admin_web.py
index 7032643..3190dfb 100644
--- a/app/admin_web.py
+++ b/app/admin_web.py
@@ -9,8 +9,9 @@ import secrets
 import uuid
 from dataclasses import dataclass
 from datetime import datetime, timezone
-from html import escape
+from html import escape, unescape
 import json
+import re
 from typing import Any
 
 import aioredis
@@ -233,6 +234,15 @@ def _truncate(text: str | None, max_length: int = 120) -> str:
     return f"{text[: max_length - 3]}..."
 
 
+def _html_to_text(value: str | None) -> str:
+    if not value:
+        return ""
+    text = re.sub(r"<[^>]+>", " ", value)
+    text = unescape(text)
+    text = re.sub(r"\s+", " ", text).strip()
+    return text
+
+
 def _websites_form_body(
     websites: list[Website],
     error: str | None = None,
@@ -702,7 +712,7 @@ def _basis_item_workspace_body(
         unique users=<strong>{int(family_stats.get("unique_users", 0.0))}</strong>,
         frequency=<strong>{family_stats.get("frequency", 0.0):.2f}</strong>
       </p>
-      <p class="muted" style="margin:0;"><strong>Stem:</strong> {escape(_truncate(basis_item.stem, 260))}</p>
+      <p class="muted" style="margin:0;"><strong>Stem:</strong> {escape(_truncate(_html_to_text(basis_item.stem), 260))}</p>
     </section>
 
     <section style="margin-top:16px;border:1px solid #e2e8f0;border-radius:12px;padding:16px;background:#fff;">