Templates

Tera filters & functions

Asset filters

FilterDescriptionExample
staticApp static URL prefix{{ "css/main.css" | static }}
mediaApp media URL prefix{{ "photo.jpg" | media }}

Markdown filter

FilterDescriptionExample
markdownConverts Markdown to HTML, sanitized (XSS-safe){{ page.content | markdown }}

Runique's preprocessor automatically injects \| safe — no need to add it manually.

The output is sanitized via ammonia: dangerous raw HTML (<script>, on* handlers) and javascript: / data: URLs in links and images are stripped. Legitimate Markdown (headings, tables, lists, links, images, code) is preserved — user-authored Markdown can therefore be rendered safely.


Sanitize & plaintext filters

FilterDescriptionExample
sanitizeRe-sanitizes stored rich HTML and renders it as HTML{{ entry.description | sanitize }}
plaintextStrips all tags + decodes entities → plain-text preview{{ entry.description | plaintext }}

sanitize runs ammonia at render time; the preprocessor injects \| safe automatically (like markdown), so the emitted HTML is always freshly cleaned — sanitization happens on output, never trusting what is stored. Use it to display a rich-text field as rendered HTML.

plaintext projects a value to plain text via the strict sanitizer (tags removed, entities decoded). It stays auto-escaped (no \| safe), so a stored &gt; is shown as >. Use it for previews — e.g. list cells — where rendered block HTML would break the layout.

The admin detail/list views use these automatically for columns classified as rich content; you rarely call them by hand.


Form filter

FilterDescriptionExample
formFull form rendering{{ form.my_form | form | safe }}
form(field='xxx')Single field rendering{{ form.my_form | form(field='email') | safe }}
csrf_fieldGenerates a hidden CSRF input{{ csrf_token | csrf_field | safe }}

Tera functions

FunctionDescriptionExample
link(link='...')Named URL resolution{{ link(link='index') }}

Auto-injected context variables

VariableDescription
csrf_tokenMasked CSRF token (used by {% csrf %} and | csrf_field)
csp_nonceCSP nonce value for the header (used by {% csp %})
messagesRequest flash messages
userCurrently authenticated user (if logged in)
current_pathCurrent URL path, without query string (useful for rel="canonical", og:url, active navigation)