From e5202d9b2bf3cbd0703987857083e8741acee720 Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Thu, 27 Nov 2025 23:11:59 +0100
Subject: [PATCH 1/7] Comment function added

---
 ...ble_alter_person_options_vorgabecomment.py |  49 +++++
 dokumente/models.py                           |  17 ++
 .../standards/incomplete_vorgaben.html        |   6 +-
 .../templates/standards/standard_detail.html  | 190 ++++++++++++++++++
 dokumente/urls.py                             |   5 +-
 dokumente/views.py                            |  93 ++++++++-
 .../0003_alter_referenzerklaerung_options.py  |  17 ++
 static/custom/css/admin_extras.css            |  91 ++++++++-
 .../0003_alter_stichworterklaerung_options.py |  17 ++
 9 files changed, 479 insertions(+), 6 deletions(-)
 create mode 100644 dokumente/migrations/0010_vorgabentable_alter_person_options_vorgabecomment.py
 create mode 100644 referenzen/migrations/0003_alter_referenzerklaerung_options.py
 create mode 100644 stichworte/migrations/0003_alter_stichworterklaerung_options.py

diff --git a/dokumente/migrations/0010_vorgabentable_alter_person_options_vorgabecomment.py b/dokumente/migrations/0010_vorgabentable_alter_person_options_vorgabecomment.py
new file mode 100644
index 0000000..b1937e4
--- /dev/null
+++ b/dokumente/migrations/0010_vorgabentable_alter_person_options_vorgabecomment.py
@@ -0,0 +1,49 @@
+# Generated by Django 5.2.5 on 2025-11-27 22:02
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dokumente', '0009_alter_vorgabe_options_vorgabe_order'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='VorgabenTable',
+            fields=[
+            ],
+            options={
+                'verbose_name': 'Vorgabe (Tabellenansicht)',
+                'verbose_name_plural': 'Vorgaben (Tabellenansicht)',
+                'proxy': True,
+                'indexes': [],
+                'constraints': [],
+            },
+            bases=('dokumente.vorgabe',),
+        ),
+        migrations.AlterModelOptions(
+            name='person',
+            options={'ordering': ['name'], 'verbose_name_plural': 'Personen'},
+        ),
+        migrations.CreateModel(
+            name='VorgabeComment',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('text', models.TextField()),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+                ('vorgabe', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='comments', to='dokumente.vorgabe')),
+            ],
+            options={
+                'verbose_name': 'Vorgabe-Kommentar',
+                'verbose_name_plural': 'Vorgabe-Kommentare',
+                'ordering': ['-created_at'],
+            },
+        ),
+    ]
diff --git a/dokumente/models.py b/dokumente/models.py
index 8c5f716..df90bff 100644
--- a/dokumente/models.py
+++ b/dokumente/models.py
@@ -1,5 +1,6 @@
 from django.db import models
 from mptt.models import MPTTModel, TreeForeignKey
+from django.contrib.auth.models import User
 from abschnitte.models import Textabschnitt
 from stichworte.models import Stichwort
 from referenzen.models import Referenz
@@ -261,3 +262,19 @@ class Changelog(models.Model):
     class Meta:
         verbose_name_plural="Changelog"
         verbose_name="Changelog-Eintrag"
+
+
+class VorgabeComment(models.Model):
+    vorgabe = models.ForeignKey(Vorgabe, on_delete=models.CASCADE, related_name='comments')
+    user = models.ForeignKey(User, on_delete=models.CASCADE)
+    text = models.TextField()
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name = "Vorgabe-Kommentar"
+        verbose_name_plural = "Vorgabe-Kommentare"
+        ordering = ['-created_at']
+
+    def __str__(self):
+        return f"Kommentar von {self.user.username} zu {self.vorgabe.Vorgabennummer()}"
diff --git a/dokumente/templates/standards/incomplete_vorgaben.html b/dokumente/templates/standards/incomplete_vorgaben.html
index e6c9f15..b8425f9 100644
--- a/dokumente/templates/standards/incomplete_vorgaben.html
+++ b/dokumente/templates/standards/incomplete_vorgaben.html
@@ -105,13 +105,13 @@
 {% else %}
     <div class="alert alert-success" role="alert">
         <h4 class="alert-heading">
-            <i class="fas fa-check-circle"></i> Alle Vorgaben sind vollständig!
+            <span class="emoji-icon">✅</span> Alle Vorgaben sind vollständig!
         </h4>
         <p>Alle Vorgaben haben Referenzen, Stichworte, Text und Checklistenfragen.</p>
         <hr>
         <p class="mb-0">
             <a href="{% url 'standard_list' %}" class="btn btn-primary">
-                <i class="fas fa-list"></i> Zurück zur Übersicht
+                <span class="emoji-icon">📋</span> Zurück zur Übersicht
             </a>
         </p>
     </div>
@@ -119,7 +119,7 @@
 
 <div class="mt-3">
     <a href="{% url 'standard_list' %}" class="btn btn-secondary">
-        <i class="fas fa-arrow-left"></i> Zurück zur Übersicht
+        <span class="emoji-icon">←</span> Zurück zur Übersicht
     </a>
 </div>
 
diff --git a/dokumente/templates/standards/standard_detail.html b/dokumente/templates/standards/standard_detail.html
index f847591..033f96f 100644
--- a/dokumente/templates/standards/standard_detail.html
+++ b/dokumente/templates/standards/standard_detail.html
@@ -145,6 +145,20 @@
               {% endif %}
             </p>
           </div>
+
+          <!-- Comment Button -->
+          {% if user.is_authenticated %}
+          <div class="mt-3 text-right">
+            <button class="btn btn-sm btn-outline-primary comment-btn" 
+                    data-vorgabe-id="{{ vorgabe.id }}" 
+                    data-vorgabe-nummer="{{ vorgabe.Vorgabennummer }}">
+              <span class="emoji-icon">💬</span> Kommentare
+              {% if vorgabe.comment_count > 0 %}
+              <span class="comment-count">{{ vorgabe.comment_count }}</span>
+              {% endif %}
+            </button>
+          </div>
+          {% endif %}
         </div>
       </div>
     </div>
@@ -176,4 +190,180 @@
     </div>
   </div>
 </div>
+
+<!-- Comment Modal -->
+<div class="modal fade" id="commentModal" tabindex="-1" role="dialog" aria-labelledby="commentModalLabel" aria-hidden="true">
+  <div class="modal-dialog modal-lg" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="commentModalLabel">Kommentare für <span id="modalVorgabeNummer"></span></h5>
+        <button type="button" class="close" data-dismiss="modal" aria-label="Close">
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+      <div class="modal-body">
+        <div id="commentsContainer">
+          <!-- Comments will be loaded here -->
+        </div>
+        
+        <!-- Add Comment Form -->
+        <div class="mt-4">
+          <h6>Neuen Kommentar hinzufügen:</h6>
+          <textarea id="newCommentText" class="form-control" rows="3" placeholder="Ihr Kommentar..."></textarea>
+          <button id="addCommentBtn" class="btn btn-primary btn-sm mt-2">Kommentar hinzufügen</button>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- JavaScript for Comments -->
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  let currentVorgabeId = null;
+  let currentVorgabeNummer = null;
+  
+  // Comment button click handler
+  document.querySelectorAll('.comment-btn').forEach(btn => {
+    btn.addEventListener('click', function() {
+      currentVorgabeId = this.dataset.vorgabeId;
+      currentVorgabeNummer = this.dataset.vorgabeNummer;
+      
+      document.getElementById('modalVorgabeNummer').textContent = currentVorgabeNummer;
+      document.getElementById('newCommentText').value = '';
+      
+      loadComments();
+      $('#commentModal').modal('show');
+    });
+  });
+  
+  // Load comments function
+  function loadComments() {
+    fetch(`/dokumente/comments/${currentVorgabeId}/`)
+      .then(response => response.json())
+      .then(data => {
+        renderComments(data.comments);
+      })
+      .catch(error => {
+        console.error('Error loading comments:', error);
+        document.getElementById('commentsContainer').innerHTML = 
+          '<div class="alert alert-danger">Fehler beim Laden der Kommentare</div>';
+      });
+  }
+  
+  // Render comments function
+  function renderComments(comments) {
+    const container = document.getElementById('commentsContainer');
+    
+    if (comments.length === 0) {
+      container.innerHTML = '<p class="text-muted">Noch keine Kommentare vorhanden.</p>';
+      return;
+    }
+    
+    let html = '';
+    comments.forEach(comment => {
+      const canDelete = comment.is_own || {% if user.is_authenticated %}'{{ user.is_staff|yesno:"true,false" }}'{% else %}'false'{% endif %} === 'true';
+      html += `
+        <div class="comment-item border-bottom pb-2 mb-2">
+          <div class="d-flex justify-content-between align-items-start">
+            <div class="flex-grow-1">
+              <strong>${comment.user}</strong> 
+              <small class="text-muted">(${comment.created_at})</small>
+              ${comment.updated_at !== comment.created_at ? `<small class="text-muted">(bearbeitet: ${comment.updated_at})</small>` : ''}
+              <div class="mt-1">${comment.text.replace(/\n/g, '<br>')}</div>
+            </div>
+            ${canDelete ? `
+              <button class="btn btn-sm btn-outline-danger ml-2 delete-comment-btn" data-comment-id="${comment.id}">
+<span aria-hidden="true">&times;</span>
+              </button>
+            ` : ''}
+          </div>
+        </div>
+      `;
+    });
+    
+    container.innerHTML = html;
+    
+    // Add delete handlers
+    document.querySelectorAll('.delete-comment-btn').forEach(btn => {
+      btn.addEventListener('click', function() {
+        if (confirm('Möchten Sie diesen Kommentar wirklich löschen?')) {
+          deleteComment(this.dataset.commentId);
+        }
+      });
+    });
+  }
+  
+  // Add comment function
+  document.getElementById('addCommentBtn').addEventListener('click', function() {
+    const text = document.getElementById('newCommentText').value.trim();
+    
+    if (!text) {
+      alert('Bitte geben Sie einen Kommentar ein.');
+      return;
+    }
+    
+    fetch(`/dokumente/comments/${currentVorgabeId}/add/`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRFToken': getCookie('csrftoken')
+      },
+      body: JSON.stringify({ text: text })
+    })
+    .then(response => response.json())
+    .then(data => {
+      if (data.success) {
+        document.getElementById('newCommentText').value = '';
+        loadComments();
+      } else {
+        alert('Fehler: ' + (data.error || 'Unbekannter Fehler'));
+      }
+    })
+    .catch(error => {
+      console.error('Error adding comment:', error);
+      alert('Fehler beim Hinzufügen des Kommentars');
+    });
+  });
+  
+  // Delete comment function
+  function deleteComment(commentId) {
+    fetch(`/dokumente/comments/delete/${commentId}/`, {
+      method: 'POST',
+      headers: {
+        'X-CSRFToken': getCookie('csrftoken')
+      }
+    })
+    .then(response => response.json())
+    .then(data => {
+      if (data.success) {
+        loadComments();
+      } else {
+        alert('Fehler: ' + (data.error || 'Unbekannter Fehler'));
+      }
+    })
+    .catch(error => {
+      console.error('Error deleting comment:', error);
+      alert('Fehler beim Löschen des Kommentars');
+    });
+  }
+  
+  // CSRF token helper
+  function getCookie(name) {
+    let cookieValue = null;
+    if (document.cookie && document.cookie !== '') {
+      const cookies = document.cookie.split(';');
+      for (let i = 0; i < cookies.length; i++) {
+        const cookie = cookies[i].trim();
+        if (cookie.substring(0, name.length + 1) === (name + '=')) {
+          cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+          break;
+        }
+      }
+    }
+    return cookieValue;
+  }
+});
+</script>
+
 {% endblock %}
diff --git a/dokumente/urls.py b/dokumente/urls.py
index a2db977..23e4fe1 100644
--- a/dokumente/urls.py
+++ b/dokumente/urls.py
@@ -8,6 +8,9 @@ urlpatterns = [
     path('<str:nummer>/history/<str:check_date>/', views.standard_detail),
     path('<str:nummer>/history/', views.standard_detail, {"check_date":"today"}, name='standard_history'),
     path('<str:nummer>/checkliste/', views.standard_checkliste, name='standard_checkliste'),
-    path('<str:nummer>/json/', views.standard_json, name='standard_json')
+    path('<str:nummer>/json/', views.standard_json, name='standard_json'),
+    path('comments/<int:vorgabe_id>/', views.get_vorgabe_comments, name='get_vorgabe_comments'),
+    path('comments/<int:vorgabe_id>/add/', views.add_vorgabe_comment, name='add_vorgabe_comment'),
+    path('comments/delete/<int:comment_id>/', views.delete_vorgabe_comment, name='delete_vorgabe_comment'),
 ]
 
diff --git a/dokumente/views.py b/dokumente/views.py
index 0c6df0a..053973f 100644
--- a/dokumente/views.py
+++ b/dokumente/views.py
@@ -2,8 +2,10 @@ from django.shortcuts import render, get_object_or_404
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.http import JsonResponse
 from django.core.serializers.json import DjangoJSONEncoder
+from django.views.decorators.http import require_POST
+from django.views.decorators.csrf import csrf_exempt
 import json
-from .models import Dokument, Vorgabe, VorgabeKurztext, VorgabeLangtext, Checklistenfrage
+from .models import Dokument, Vorgabe, VorgabeKurztext, VorgabeLangtext, Checklistenfrage, VorgabeComment
 from abschnitte.utils import render_textabschnitte
 
 from datetime import date
@@ -44,6 +46,15 @@ def standard_detail(request, nummer,check_date=""):
         for r in vorgabe.referenzen.all():
             referenz_items.append(r.Path())
         vorgabe.referenzpfade = referenz_items
+        
+        # Add comment count
+        if request.user.is_authenticated:
+            if request.user.is_staff:
+                vorgabe.comment_count = vorgabe.comments.count()
+            else:
+                vorgabe.comment_count = vorgabe.comments.filter(user=request.user).count()
+        else:
+            vorgabe.comment_count = 0
 
     return render(request, 'standards/standard_detail.html', {
         'standard': standard,
@@ -237,3 +248,83 @@ def standard_json(request, nummer):
 
     # Return JSON response
     return JsonResponse(doc_data, json_dumps_params={'indent': 2, 'ensure_ascii': False}, encoder=DjangoJSONEncoder)
+
+
+@login_required
+def get_vorgabe_comments(request, vorgabe_id):
+    """Get comments for a specific Vorgabe"""
+    vorgabe = get_object_or_404(Vorgabe, id=vorgabe_id)
+    
+    if request.user.is_staff:
+        # Staff can see all comments
+        comments = vorgabe.comments.all().select_related('user')
+    else:
+        # Regular users can only see their own comments
+        comments = vorgabe.comments.filter(user=request.user).select_related('user')
+    
+    comments_data = []
+    for comment in comments:
+        comments_data.append({
+            'id': comment.id,
+            'text': comment.text,
+            'user': comment.user.username,
+            'created_at': comment.created_at.strftime('%d.%m.%Y %H:%M'),
+            'updated_at': comment.updated_at.strftime('%d.%m.%Y %H:%M'),
+            'is_own': comment.user == request.user
+        })
+    
+    return JsonResponse({'comments': comments_data})
+
+
+@require_POST
+@login_required
+def add_vorgabe_comment(request, vorgabe_id):
+    """Add a new comment to a Vorgabe"""
+    vorgabe = get_object_or_404(Vorgabe, id=vorgabe_id)
+    
+    try:
+        data = json.loads(request.body)
+        text = data.get('text', '').strip()
+        
+        if not text:
+            return JsonResponse({'error': 'Kommentar darf nicht leer sein'}, status=400)
+        
+        comment = VorgabeComment.objects.create(
+            vorgabe=vorgabe,
+            user=request.user,
+            text=text
+        )
+        
+        return JsonResponse({
+            'success': True,
+            'comment': {
+                'id': comment.id,
+                'text': comment.text,
+                'user': comment.user.username,
+                'created_at': comment.created_at.strftime('%d.%m.%Y %H:%M'),
+                'updated_at': comment.updated_at.strftime('%d.%m.%Y %H:%M'),
+                'is_own': True
+            }
+        })
+    
+    except json.JSONDecodeError:
+        return JsonResponse({'error': 'Ungültige Daten'}, status=400)
+    except Exception as e:
+        return JsonResponse({'error': str(e)}, status=500)
+
+
+@require_POST
+@login_required
+def delete_vorgabe_comment(request, comment_id):
+    """Delete a comment (only own comments or staff can delete)"""
+    comment = get_object_or_404(VorgabeComment, id=comment_id)
+    
+    # Check if user can delete this comment
+    if comment.user != request.user and not request.user.is_staff:
+        return JsonResponse({'error': 'Keine Berechtigung zum Löschen dieses Kommentars'}, status=403)
+    
+    try:
+        comment.delete()
+        return JsonResponse({'success': True})
+    except Exception as e:
+        return JsonResponse({'error': str(e)}, status=500)
diff --git a/referenzen/migrations/0003_alter_referenzerklaerung_options.py b/referenzen/migrations/0003_alter_referenzerklaerung_options.py
new file mode 100644
index 0000000..e214b19
--- /dev/null
+++ b/referenzen/migrations/0003_alter_referenzerklaerung_options.py
@@ -0,0 +1,17 @@
+# Generated by Django 5.2.5 on 2025-11-27 22:02
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('referenzen', '0002_alter_referenz_table_alter_referenzerklaerung_table'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='referenzerklaerung',
+            options={'verbose_name': 'Erklärung', 'verbose_name_plural': 'Erklärungen'},
+        ),
+    ]
diff --git a/static/custom/css/admin_extras.css b/static/custom/css/admin_extras.css
index 2e15826..29450c5 100644
--- a/static/custom/css/admin_extras.css
+++ b/static/custom/css/admin_extras.css
@@ -11,4 +11,93 @@
     margin-bottom: 1em;
     border: 1px solid #ccc;
     padding: 0;
-  }
\ No newline at end of file
+  }
+
+/* Comment System Styles */
+.comment-btn {
+  position: relative;
+}
+
+.comment-btn .comment-count {
+  position: absolute;
+  top: -8px;
+  right: -8px;
+  background-color: #dc3545;
+  color: white;
+  border-radius: 50%;
+  width: 20px;
+  height: 20px;
+  font-size: 11px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: bold;
+}
+
+.comment-item {
+  max-width: 100%;
+  word-wrap: break-word;
+  overflow-wrap: break-word;
+}
+
+.comment-item .text-muted {
+  font-size: 0.85em;
+}
+
+#commentModal .modal-body {
+  max-height: 60vh;
+  overflow-y: auto;
+}
+
+#commentsContainer {
+  min-height: 100px;
+}
+
+.delete-comment-btn {
+  opacity: 0.7;
+  transition: opacity 0.2s;
+}
+
+.delete-comment-btn:hover {
+  opacity: 1;
+}
+
+.delete-comment-btn {
+  font-size: 18px;
+  font-weight: bold;
+  line-height: 1;
+  color: #721c24;
+  border: 1px solid #f5c6cb;
+  border-radius: 4px;
+  width: 28px;
+  height: 28px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0;
+}
+
+.delete-comment-btn:hover {
+  opacity: 1;
+  background-color: #f8d7da;
+  border-color: #f5c6cb;
+}
+
+/* Icon styling for emoji replacements */
+.emoji-icon {
+  font-size: 1.1em;
+  margin-right: 0.3em;
+  vertical-align: middle;
+}
+
+/* Responsive adjustments */
+@media (max-width: 768px) {
+  .comment-item .d-flex {
+    flex-direction: column;
+  }
+  
+  .delete-comment-btn {
+    margin-left: 0 !important;
+    margin-top: 0.5rem;
+  }
+}
\ No newline at end of file
diff --git a/stichworte/migrations/0003_alter_stichworterklaerung_options.py b/stichworte/migrations/0003_alter_stichworterklaerung_options.py
new file mode 100644
index 0000000..948e9f4
--- /dev/null
+++ b/stichworte/migrations/0003_alter_stichworterklaerung_options.py
@@ -0,0 +1,17 @@
+# Generated by Django 5.2.5 on 2025-11-27 22:02
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('stichworte', '0002_stichworterklaerung_order'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='stichworterklaerung',
+            options={'verbose_name': 'Erklärung', 'verbose_name_plural': 'Erklärungen'},
+        ),
+    ]

From dd6d0fae46c85566be878fa4a4665a47e577d24f Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Thu, 27 Nov 2025 23:23:51 +0100
Subject: [PATCH 2/7] Comments migrated into database and
 data-loader-container. Deploying as soon as merged.

---
 argocd/deployment.yaml      |   4 ++--
 data-loader/preload.sqlite3 | Bin 921600 -> 921600 bytes
 data/db.sqlite3             | Bin 921600 -> 921600 bytes
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/argocd/deployment.yaml b/argocd/deployment.yaml
index ab2534c..deb99fd 100644
--- a/argocd/deployment.yaml
+++ b/argocd/deployment.yaml
@@ -18,14 +18,14 @@ spec:
         fsGroupChangePolicy: "OnRootMismatch"
       initContainers:
         - name: loader
-          image: git.baumann.gr/adebaumann/vui-data-loader:0.9
+          image: git.baumann.gr/adebaumann/vui-data-loader:0.10
           command: [ "sh","-c","cp -n preload/preload.sqlite3 /data/db.sqlite3; chown -R 999:999 /data; ls -la /data; sleep 10; exit 0" ]
           volumeMounts:
             - name: data
               mountPath: /data
       containers:
         - name: web
-          image: git.baumann.gr/adebaumann/vui:0.957-xss
+          image: git.baumann.gr/adebaumann/vui:0.958-comments
           imagePullPolicy: Always
           ports:
             - containerPort: 8000
diff --git a/data-loader/preload.sqlite3 b/data-loader/preload.sqlite3
index 58a6294adc36770293115110731a235821b1d0f9..3900958aec61298020ef07dc7803f4b321aaf4b2 100644
GIT binary patch
delta 5736
zcma)A3v?URnVvfjy+<P_aYAsMj7@?Qh{TLW(nz9^D7F*F?{^&YaP$~ik|kNz(-un{
znG@KBkeAp@Tedx+h0^C)9F>SJWl0Kj;Q+yD9;eHaUD8vwO?T6{p)E9z?cR}WP;3V(
zow;{r{`>#`cmMxBzPY;&TX!9{?yo3oLJ;IUynYF<RR{uH2i9{$6JprbIO+L2O1>Pv
zZp<jNzo9CzHN?fNTvxA>?Umh2TqJyiFIUBgL`B<r0;$^Wh{gSGUurlS7Z`@&2AsjT
z5Y3)nzVz-$+&>(S85yHl&$4<WPaBPP)@nDK4JO8HwOU*6g!<bYQNb%jg>YI3f37c%
z?86t24-DVj1jq9htL4Ev2xQfm!!taT2nk^c0m}>|hogf|7kqTOf<h6`KtzbfhQqT4
zXPdZ(Lz3D;5IHl8u|_WU`=wiy;JKWI{t+oVU0sQ71!CFP@ReD)p-OhRauv1#h{s<h
zmS?vZXmB>`Gel)rl@6;%MfP!gMfRFuuO&<>u_~oA5%&!YMu!s->NKK;(UpEnYA`)0
zND?t2S`^2yWf;Z*aWV)N15@_&U3Y@@M;M&OOsZp9dAki&9m{QO->Irxfv;KzKI{2R
zr)PR(%AM<9y@sS*2u4;QT9K?E&%mUSq%OmwB$C;{DJsirl}fHW8{HSw#D!Q~LeK-R
zY<e#}&N6zVjb_buma%huHxy?!V3M9gSwpf=uO{Le@_3B{F`v_Dwyb7h>fmp6BHrlh
z9kYf#o7zX1u(c}`=xj?ESC4fE&A#6LSbKX<e_z74Dc!l<(|l)eTfI3M^Yyp8Qi-v_
zNJ~pY^B8lFl#B;w1`NyEIh&oe893I+^CqV!<PZB}@u)LC9Cdnxjqq|g6Cr0fY=9jv
zNh4z|j5Ld*R3p;>3SCfSFFom7G&3G;c8)ceEGEv#W&L}bz&Ep1%-0W2<0_0gg;1BN
zQ`ASfvK?<wd>K{)ZUBI3uu3o+Ih2%g{23gQ`Ze-|`V2z-C8s;Q1jy89q(98Sq$+pj
z2NZq>On!M`2$U8Cz!4?D3HT0BS0%~o)YUxDX{M?5&&pNsxs2R{Xn#yjYH98Nkyoh(
za*y`ksSl_;b(=Oo9n|h4&r%_6J@n%u$5&%5Ai#{cJuxmi;u?;|(&-^S=^hCLe1lG>
z#ghnInZ;5gb8?Vz`C@Tn#2@Ck@KC@UiABvqG#%!gk+eIsNNO}T%JU2>*amHEK=2DG
zJ~C*GGb!&dBXIFCm$^)8<YPxi#!N0D8jW-JvSUG?*=u$slTju-60(J(VGAX-vJDOL
zBmS6si1CE2tTUKS8k3AaZsfzMQFk;Q&`FK5%}3~*|HRWkg;F2GI8q-|{|giG5hcS>
z7$s%yFaM?1VW(9u<>b>}13J|O)vr|lp*pR4SM_t%tMF|Vqfln2uiz#Va$1G~)P$TW
zR=+4#C#8x*ri#^j#p*<{dN((HrL0^@eFSrO7NM@>bvhs=@vQWRmXE0NXDa}OuYnm^
zAd9#XC~*~a5qW}Kk5Je0x+zc&i1j4=ORzNg^?Gm|t%S-Hyk>tGrc|n^3&;~14+68U
zV<eXvkMxIH8`XKwSHNyea=B<$rC8&b<PP4W)E^P*kJJ_FA`H}jQ!)ZqDgm0m(gsvC
zjN+dW>d(|wYC2!G3;dS41;?OJ(nX89pFpV8C)8z0e1Reg;{3IJK*7*q*-k|9u%chK
zTai=@D|`y4?4M=dl|3W-x-2W(Bior@atvGpxa<|#(Y)?wpdXh4zX=CnDV!JxNfi!)
z#cHTn1&WowSow<8pj7FBw^#}J*MAN+DzUKqLS8-v-a?lssue2~OBFhWN`77bi2{>P
z%P+v-5QOCLZtOFM1g1nmuuvA<VIWX=@E1y7p&Trf-a;wl*ZvZGAcsrrtD^ivFbGun
zKODn-iX6lI7F1T4aAeiGo2<0?4}J&M5{g@>Q7Id5i<)U*$m<Tv92EBageSlAui#PL
z?PcU;gxXF0ih7oMjq*}ksI`<*`?mIn+TUrP)V68ET1E?-z@EHGichXYRpUmu02a2(
z;_}2>EWB;;O3VR@Yg|Fhn(SuAZsg(OXyJ{PMRUY(2{dwchB5GrjbTh>^Tn*qZZ;Ws
zo?|#0b%S^jOH1lTyV(f$YSzYDbdNz?`6pLmsRJuX_1g&bI+ddInlkMR+8&7g6qzO)
zG+)*9sNaUY_?~)mZH6Y041w191-f~7(Bq5?VLIjyduX^((JjufKavPKC4xXF;LGOM
zj>g=+M0k)M6yVKkKaHp325>fC_EYR*43BGGL`2Pgxk>!WG3<HrMa@T=bDA@ncQtQl
zUV-l3P%GpZih@&6;gxr=Ew5oZBrVGK<1tbFD)FcM@B#cEf4`EXz9lUqm#P1uzEAy{
zI!B$Q-lN{6j#EFOCaG^hGrOpwnX|}Y@%#ITek`v3Hnc+g233C>igPM)=Np6qg-(9-
zG_h^TZ6tCT(QYOmQ%|bSs}zcJ3KrXeJ_|0&UM4mom%&9OMTk|0<&3!P1>$M(@mFM5
z^A{%xGlo-YWaR<Jt@+*mDtidzAAC`k1bOx);(ZwoN6??LRm>mY{*%X#5!Wx>Mm~;c
zktnA5nFdi^SLu~*`OES+u?4#yeF?50QQ50902Nx*kJMz=$d}!754w9mJpNDE(yAFE
z@Y$%HLwS(r#OWilRq~l;;^axxyf`k5#;a+mq+8p%>DHd+X7R(X;xxUUu1-Xx9C`+v
zu!VFN_lJbfTb<|x_lac(@d2<d|L~;jJhmMI&)73H@@2w3XyyT!cwzKrSZ1LO_&ozw
zkJoH=+gvwmi+oSq0dZH%;9f{obbJF}7MN*JO|Pw<p+?Yr^|}n3xm~_&0AlL+VoU`>
z1_8O;0>_%Y+)V*}w*cstSwM633TT#;pqXh<y)J)iUUmuO-9M4l;4t%O5)QH`dUOYd
z>+<-1aBbD2)3T$}a{Mrs!S=v`sQ6fix8N*Zj$OshW3OY+V|$>+1Uh~z4mi}5gq!kg
zIA+`-r&r*BM@=3fD8z-i!c#?|+vf}q&J+G(ISyD9GA_?twUY%2_qn_KW~nwZRe=LD
z%H8O$NW+o$in1HM&B#vNf`hwIuEg1l;N8c(Pbu==r<C8k8>_(NqI^neMlm_;_FE`x
zc%)Z`bfD!5xW+)<N;_O|<p}%ZaT-!YTJVSIrbIL?jb;NlB~^LrDdn5@SCep-$>pCS
z+V{yHYxb&rs!hrj@=s-_i5Kuam=CQ3G_-$Kp8GVfP#mIB{CRu_3NzBKy0+>&`vDEf
z0OVuy%PhmxK88)H^4OI6`oIdwiwZx4kViEK)nQem@^%HPeP8yU#J}K&p#3zycA{!A
z(eg-#<I6Z&c7N{3c-v4@#NO63X6kF>(&5xLeO;ofE7Ba~`R*QlDBvHc-yChM^*7db
zIXaqK223UUg!I)_vW-ksEh@PEGS+7h8b^Br^|7W@z|oWaM((-sHc!)Ldw0^E-jwQ0
z4tn*B(d$m@TQ|qL`Bv8A3G^|2dM?>DJech0NST=JB^c)HRTEWZ1q@$CDi^@e*Ra*z
z((dd@nFlwsb#)^no>cSbklqoEI!0YX!@<_R7GEgp+Qjs_lhH1B35Gcv;zSiyz);Fr
z7ox25Ff_LH)o-<PDO+bx!qjgXHG3SR?*1`ubR^<x3HHZ2*%70)Pw!0DZDCmxZ%f^X
zp>)^H)g8GV<c_?!8sq}G22`dfAj+OQL1(WWy*_@M4nFrdzKkyy5w_H~rTmVL&UXFg
z*jR&u3Asist!#3uBi7s#*wztjclGGo^v13Zn<d;3O!oWQ1a_p)6nA?2yT`^7j#zgv
zo{IJKS%!qcMq5t<!;Nq0jd;wp$;J+IeTYxidD?heGBV&}dMu${Z(?*bUR$?4?KAs(
z(>>eUJ8DM)sYJJNxIPrv8tgPXwzfM14!)zY)wyjn<#P-*rA=N(gSoZaTWe>NZG8<6
zI}|mh8g1?EBP`!s&yDof*STG_BcAQ)UPr&TCe_yxH#b?B#^!j4xiN~R+(i09`s)HS
zvUHBZ+1YW3A&F(`3_=ZQpV2-*{u?Qf8qK7pSAA8Tfm2dYYf=+o6+%^lOa%bqTT{du
z@$XL(20d2vT{y!iev+DagUw>H@TR_rkP@LPfD-@*>qx-wQt=rLQMtKYh=%;Jm~;SA
z{lLQyKY*3mC~_+kJO^Q|M$XbV5rj5sz&4<Cz(ug+8&`Cmmao_#9U2s^;3YsLBk=Rs
zVz6;0vzhIi82Tb3%oiHr46M;=<(b}z05nnskpR(olBi*}l&H<^0X!M7!7pd4$;J;%
z_zQYN;=oB_U2|6g9=AyQ936{0;lV;70&}p#X<#%P7|zU_jhRIgJ{b2Jkl8vv1XUPO
zA*De(ULSJ$gEZVFqCzZI4LL~{9K7CHAJX&R=9je?Ohy=bn`2^7ikb4xd0y{(s2cha
zJk@skA(*`a_L`YP2^e_k6w6|;a#qI3XEslGRmkEEV4@tFG4YIe*Ku;Wc;FJTRGeC?
zF^zu#>%Bk0FkVY3^DVq_OYFBA`qkf<Z`NXGjRqUbF(y-{Y(ju;IgsHcw-&w=o>svj
zwbfv>(=BlHIsG0~>V|me5>Y0$536m}JhSdbt0w7)2Yw}(d4ti&8coL1sRXA?c^;qA
zV26p7a5H;H)I`Wt#E0<qEs=?kZRKym+rlHPrTcfJEB{o4j8NDea*HV6Mb_&SrxXVj
z9f~FL59QyH2jvzx(cYJhbD3@e0i0tY)>7*X(-OO&dyD6I`ljM3oioa3x}X+czc8VZ
z^orDDA<fRBW|4o4&mlFEYEd#@mCbZORd&MyTu4%b!(_gWJ<~4fbd<29S&~%f-FQj&
z=(XMOure4F!p?9Eo}|Xt-J5BH+UA}GiPZdFE@Ys!Xka0>B^kKy#?H>SV9m5Z3wO26
S=VWvGJYO}h{Ri^$qyG;qguIym

delta 1544
zcmZWoYfKbZ6uxKfymw~KuJ0<yF0M+Wth1~rppDju&{yz}wINLvMWl@i717jIBWaY>
zl!va(XiQsv*xF)ESXa3kHASUHqp2jKK?7Brs);SQVob`z(mSC2)44hK+??~>?|dh7
z?v9469SvFalYA;6<Q}&UZc_<?6?<kzB$b4=ejF?Q43%*_{AQIJeTd04Rqlx@-dtTO
zeYxTRd%qm-8JDNQ_whOYqo#Z{HJQEvj_-gtIjV#L^0&z;bOAW$PD`&u^Fn^O5iJdE
zl!bto<_b=Dx0n<i4AsslHZ>a1iYhmiu2{RVtg;;2iNOmGf1{_<^pR9$#hQ&H`HJzB
zM!<=!gV7L)w$GXYuO72SKaJ>JQDtd%e9_YFdepX4;$4NosU9mv1oHtgAK)r3__nE4
z<%3D87QC)S8){2O*<pV;Gsn)%iOddVX3ojT$cj#^dkbRGfPK_kHAxtTs>!CQX%RCz
zqh?)*!|bd`#-=qDn_Nv9c1C7;*iO&Lc8S7vPGqjmr3-kUU@zW}`&Qn<RD&kN%L{_(
zc3Zq=RZ->oq755N4zBgwaFjOM7(LQZ!9~XO_>Chd&X+`yXn+!Roh1pbGbM1H=w35~
z#l*U89ye+|rTQW*N%>oD7r&&XQj@Tl(*y-JE!&s|tbCr4FR-_Bj3BU+uNhN-_0824
z)$i&wtXyIpxBkI=>lSt*!ztEBxYw$~^;RzDm}-eZ`VKguY{MV_@YjPN1NIT@W4@Kb
zV~qFR@p$P~JrP$D2Y|zuYVkzBZ!8Y?bdz8|KE=QAKGVH0#?2qo+099SVyY}^!2PhZ
z=&&;di3c^&RaI-wWJ(((yLVKB%}j@Lg42BmMq9&KqnO|TKEub3-2&5{SvEZ8z=a-G
zJRf$_fJ9wxcekj!n}SGR5CiseRSf)|1hW1D(EYrj0nX-zo*=qF!L0!}NN~`N_97ds
z1J(8x%dJG+rWUH3)iSkIEn>kI7z7qP4}~J1w?fu>5f*B+SWR=aUlzEe_av6q0i6n;
z%}z(T3u}37gU&i1L7JqF$L+ijIqVn-2(eK%%|li-1fP4846BCVPW&AY;RP(gJWNB)
zx?=rgJ+f*z!+NW_X0pI)Cetl@k_^K~uobspy5X~$tYwzZyl!qa^Nsz+GLC)XVZJl;
zDHSV>v&1p#mD$ex7JAs}@`8t_uX)(nt2FNdMJRKWda;5x@{E=35x?q5GO&^VX+Fe%
zVk7>6U3e3(;UzqWr!dCHdN(?aby6X%@EqkgrH7pDXWiNUi=?s>2c?2BQ#{a3&|@tz
zt35IOp0280YM8DR4ng<GB3mRU(4g4P@+RpZuRFlHV^Ss`c0!Spc_<5?ly1w;)_U<-
zbBhFtbh({au#HF`SUb(##(9J2&-HX|wNj)^6b}n$gbA<>I-r9zlV))YrzilHd`!Ma
z+399!Gl-f-mP7;gB6V?<Umm|aEI2(SFv0olj-auxnS7DIEJ6x7;$61-lssK@dYhyH
zw(x}XDW4$*^)NJRS3+)1C}IQsL@eQ5t512Ab+o!<pUO)1Y2VDF6KNKI%33Cm4+<>n
zx_0S(cZh~k*ieBE{ugI2pT86~yz|C`)wE4#w9WH;#sBjosQ<9JOl&h~gB0XauQ*1z
ynIiqjk3TqexmhswJAORG?J~DZ+*-NaW&6s_a-^x6<tRH$_f?-)ne~O)yX#-uo4S<%

diff --git a/data/db.sqlite3 b/data/db.sqlite3
index 96d3df47323ce0d748f9213bdc210d5e9782ab7b..3900958aec61298020ef07dc7803f4b321aaf4b2 100644
GIT binary patch
delta 7045
zcma)B33waTou4;{MjFj%<iw5>94E4qU_v5gMk8q?g^(zY6UV1~#x?{;wj@hFWLuXH
zHW-Ny*oBlNm@<X7eCa_sO9^f=wB-m_7e20}3E7q{Ti`40LN`kaEu{py`ya^$=K!kt
zMsM`{pYQ+Py!Zb<U3<WN?E&|`l7d<c!`_1X*KjY#Fx0butwhygwjDJGga5+QO8~CP
z7^eTomlCU}Q`5A$iqYMoyPP^jMX1P3nV?W5jcX~atkaiBMtdV;!|`ND5Co|^FqjO*
zr{7w#X#GesIvh*b1-sKKidMU9vD>|(+v{}N9D>vBb~mg6`5nG^C>)B1Vw0iR7xK#J
zUUK17_wbjikYw5Ac3pKTg)N`(1&0SxL!p@FfhcsRhvR*L9{3sP84Tt9=^hEi6T`7N
zg>x*u!$X?bg<O=JA|cwPng3n1&4BKnaan%M=}wfF65Ekda0j_;nzohc4wNn@HX`Mz
zUr<Y?x7jS{<aESViKOWVZ8jZIW+tj|MZAezieooU|HD?Sd)=~<s6xuYCv;1v<#jEt
z7-t~L41rWK(%lyyPL1#<Fe8Lr`xI6XR+OWp5}|mWoFIw`LIU|gv=BL_Ppn&m);=PT
z7Q(?CnWp_7oH;VH$$t$~x|CeL8hsv;*=Wpm)iLu%*UD8K--8ic31(8b67Dq^O^!2X
zWSqk?8zp^dQKi8k6-~$Y4zkHmBB^=M2KV&jEtV-!u-ZKq(diWhuOznuIkS<_<a~w-
zP6WA%k)DBI*xsFp1nf@NN)g5sJ}Xnnnn?SEI~LsR9~ENmmZARU#*}^KMC+h4(%zNu
z``fxYQjyJ*&7HxzHG?~<oascQ%ilAWn&=y;udl9~5H@I|bk*!k5=F1%@roXsB-&-!
z5eN=NW6?x19!L(y1HsTHxO)Prp+GEVgO1M|U%{Q5f-c{DiA*)hbwNM<{x?c@R>woZ
z>Y8n1J?U`oj%c#0x38+pUAHpS+O)1}a$Q~DczAov<(4`l6UlTel$hAj5SB*6ZONLN
z&RSQ<-8tHsb9LUF_jo1I=5RSAyEGlWr54>aT_)Ul>uHi9_~RJ=0e_r-XQp7+bG%$Y
zRG_o^La;<Bni~Y1)27SkJ>&S_V>cUL!}!0?m=6>po$)p8g26n<%)IshPhJZ1s3<p^
z=6_L$#0-d}07Lv4jq)siMnxmcX@2bwX$F25aC<P*Pq~98i|HTS8NQm^WBLvMTVCZ?
znELr!O?$bM{E(>%?DTL`D~Wp4FO2pE6H<J%XE>gioE(tTy`%m8k-k8{6->q4!a|M7
zneG#MB8jAZBpQ>X*g(H?BoTLp;*&8cFf!RYv_NB;7?)*140-xIVt*(a8k0x*>`7rP
zJS>Ey<V26NKx2xC<D(Ofo=`lVlr9%11|!a}vnQR73$f85Pb?mD@fw$Bpidr+CVB^i
zV9YHB1}D?@v=B|&<=EJGZ+x=ftT9d3Jz|-OzVdCv;QWUWNB%?pe_$Zq;dLYqQ8LW@
z{dYz)ae{ethCY1<GBfWoZ!`bNoM2vNe#txuXqlilOrQRQbU3gRIs)Mi?0CNURlYf<
zH4=6--@KY{UdcBv&z%0Gpvb_#17mm+<3CZ&W~2?`N$mp7k1*=V62z0MU_>r3ilhM<
zNQOU!-OR1U_)k^yQB;JewH#cUTdZ=lj-pi2iXOvDK?4u>+=n0x28MqZyO|AQF!W|Y
zv&#mx3q&^=)!=35dP1|iU`{08l7waxo^k#!82=ak6aExL>kqt+A`J$FtDiI?#sZ=I
z2;)EE&+w<!f@{%#^NUFWh?*>(m;D>~%m0o4KqJ4)Q#rEw>0YE4EHT|Rn0~juOLx6K
ztsmA$^a0&Zboc7Mr@K=(t=pr!MlC#oEJ$%Zg?>xw9@iaK7CeoD>NQWJj|goXHjyZ%
zMVCNBT0^42d^3=5`twaR-$e3FpVnAWIM=98{}OFB5Hb2)l|G7&;|%>7{Wm>9pQhi1
z&`^|Sq?GvF2t^ohG?@F&nIKTV%KRFALc@~$q(Z-m`f%n+5Nu>hOB^J&eD#+s%Ia_5
zL+dE?qRO5|A1}YSfcpUBujk+9f5<<>hxu*%CA`7(qUk}?d!}!g8ci{iU;-A<`#h(7
zV;Rm&*<r28ZLax+Ms~Sm&%$Md59JrW99eXDor2dc!;0yW?XCsqkYQc4OI|^+$%01^
z90li-MUU6%u*tF{NFM$y@&eJKiQBzSJM8SDM|7E0@M{ba7juUc+Je`EuK|uMz8IGk
z^KPn0eZ`8qaG>r}XaV1-Rtvb7n-&D~jr%s>>b?y`(oUp|vO<p#e*)1eMwPE7UM7hf
zjJK%twFHL%oMhBnZYI)&gq2kk`T%hSU{034NFp&L$MR-o9weHGWt{OvjDMCN<E?Cg
z>0whF1n)RE$yKx8V%v-_g4lh=t(6%Ig=HvwOEhGu8}17RlA)L-5sd{cuzgzU1F`5x
zYA~SXGnN#9b<Z45^hQ##K1*K+9-etDIhnMflWM_Z#D@f#WDj8qyN`A#mmMMQ;SRCy
zuy3%hu`jdFv5$kf=Zt!qz;SdO1Rj5h*!B!z#wHbdADK{$Pf~wXhxe1;v=J#or$Qeg
z+tjO$knidtIE8BG3*-as5QM!DQ|gfVgoS#Z+3z>1d)H7Y2o8HEL{q~B>V$E>pV20(
zde>!Cn9$w8!V>eI%5I{bW%v8_Im+vG)TIPO?^_D(r`D(rKh?s5nT5I%63HkR!A0s%
zucZ9IWcrOl@6wodQFod4`wi-EV$>Q$SUDEPh^klHN2q%>VY31QxI|sGoBAETjN`wr
zt*IaIf8y`wf6u?cpX6WVpXZ<Af5so=zYl@9md^*`Bz8c#e=pTVB#l3SI8cAYjXwbL
z45M809Hqx0Oh5iMwWDwahkbyVwsJQb4>E5tdi@)Ek=TX*5S`Nfg4%?AfKFj!lu~wp
z7L*+iQ{Pr@dR%u#J#~<B5+rZLmhJalq+b7o?rNl7bx4;+s`x1Nx{id!?61>h!k=L?
zR>>pOXYa4zZo*7hoM4}3G3GPIYUrhZK_{tg#FhA?u#(1gPwEf|G#Ia|$gHA^H*CPK
z?^d4r4zZ|gHo^M*6+b7(#O_v3KcZVs&$1~8kKxXR$<TPR+@gJ38X8+I4Q+LG%A4OJ
zEta*G^3;en3xnMO;Lx6u(V@^6T(2~vE0ls;$!@e--F;B^7SRcgXS|sTx;V4}&+LS$
z8yf#IU*=rvjt0Bk!LZZW>*@J2UhF<)7x-N=>-U9372kKs;{I8Na?2&<vneO2FJGMz
zGZ)jv-QZKxSNoJpbitvX-jF0Z!_t>JbZ^d~#d8jwE0^=8aGp1_4CSlUi&WkFNbUWZ
zu7ZS-$I~#$;`rfR1Zh^uedyEWH=NcTK24Jchzzj@CZhgBGg(iHWD#+Oc#C+JxQEyS
z5?OreA`(fsBMlkKTsUUUVJDWt%Y!?Dp}|lxbT09Dp4b}+#QM%7{%Q${L>w~N;JISQ
zaun$cb63pOHrP>kSDm<Ywz+)WgT0!koo#KF_R3-st;3~x#%2jG-x$74uZC|k+_j!4
zA!vm@YH;EN4c&eL7j4(I>#!!gNDr$d)B_e@53GH$XfkPm)Y}q@#w@j|_@p+QZRohx
zsP5y2SL*cN!Lc*gchDV*$->lJgqq0!xr+EJ@ffk2s3#WTZ{zpjVc4wy1Kz7k)l50F
z9<i5Z{RRw`m0`stdgXwHDdW1cjSPk|hCKADg=u3qWgCF0K97iHjLf>S^?-QtNUDsn
zvSPLlkac<FCuPhftRq_sh%=A;zKmJJTC+6<%&<C-EG=hNvX^DI1J8OuR_T@caz+Bp
z)w6n5>DA{~FmAS-gT;fUKgLY2b3bKoF-DlphNbk!x)apH<Q^h|Z$TCa+ev!nV^y!e
z-GY<%kh^f0Xny9?<v-eoEUI~gAvWDe9A#AEsPVJzrJ6p5ydC2Xv$q;!OpW1UJ#Knk
z_g~b{$=gBGBzZ};Y#~*DU6b$YGVbYpGmlI)4%Ci#8`~xv9gWgtY;1>hORA-1q;61_
zTidKd{n75Kt?`=5Xia5{uc@xS+c7U!(CYMgsYJGHLC);g<?yyp&3Jo%RibvR-`6(%
z-I=?m8iTc4y{+lq$<1TU>AtX4u!nmmtqofft#X6t3ifvh9absbGTfJLY8rD0o%4J+
zCtt~y736&Qx)R|6K6F%X_tyIZZDY>9t>Ts~qocvGy72+4FCO=e_Y4dVHgwcShT=V&
zh4$Wbyrp-Z59cIB*)l%o!~6>5LIucqKGZaJRBiW4W1i-=l%vZr?hN|Id%Gs2@zIf<
z`oXS5vp8yZcUS}IE!#xVA$!Ko_F;bJHM8ZBL)6p?GdR-b`??}0??`=B<5<+!)a<uz
zO-xk#grS~sSA&?|?n~6Q_3vmJ^!Kz`8?E-1CXXvtJ(%u_G={{{4o5N&?rNQwNcj@2
zgUPW(TZd~P)K}was}`iGZS5mLXJxvk$yqfdr?&(fWlwsfJ0i5XhT6la@$qEkmd?qD
zGul4c*6DAm9PJ-Vwc3ZPhWfV;HamUW{ega;+*H#L*fBm9@eR~YI>NqcXG3ea(krGL
zJF0zNAk~c3c>MlRQLd|!M%$~l^!8Ma20JI)eO=*-v5xwrv(_cl)Fp?6vx7B14ZR1-
z+FiE`993-0VElmTd#0V-zjGmuWe>9L#xuqYyjCG2JC=<x7+;DqB?u`m9Hmw%|9XtF
zS&6*j+{sn`yul&cJT8Yzc64Ni3>aU60top;UkVN#l<%=r=~jOzJ`_zPv}3RGox6AM
zB<AbL=g1B?{Sw`F$<>h^1RWJ<2Qv6zC7ySHp#)CQOE+pKLU}FZJV!JoaQ5M{c_fF^
zDRyKBzDkMkl}aR=Xm`71p*`CVO3J_!qy&yp6~eZ8V(0b%j(t3Emf?1I<nC-VCpVyU
zAEQ>+wWQ#XP1|fOiDUpyjdBq<$9I^@cBf5{oU+rNS&)rD+$&IK`}rX#Bd8K>7)(=D
zLxJd^1-7bqD3K_K#Ha;kW_Zqq_WPf+E4pkBJA~fj%l2t8Gpsq!>J?X)gPl;Y+-tcS
zMla`k#q2o_1YSG4blKdJTd>QSt=TYxE!>E*MWDtZ3(C5uxFyQ|_o+q7QP^arzM^=z
zG9?IM*Zcw^hxBSiL^;^Co;}{8%PZP#9#Ik;j!Z!|1ZE|aku|d}xf#wVVM=Yc*}ax}
zn0<k05ZAh)-2OgQp!kQ4o^n}OeYRGIc76xdo>R8j?V{ab*N%Tki%K44@l8|rW00<o
z^BZ|&y2I3MD&&qqv9yURV2`smvrblLe9m~2aU=5&=I2a^S#J1);UUAYVWYvQe_Vf^
zUZDR>KSrl$nZ|U7bmO`WI-Gix8m64&r{ojljbt;qjChYYOk|1m1dsm?zZXy9n{gUl
ziC#pvVShm77`h+QfR(Cq3HPFo-I5)JUAGhV;bOh=O*6NiwP#0Qua@)38)j}bcUg8A
zc&c){w@Eqn5W7?n3b;j_KN|ylD2H=O-9zj}O00le%gWljo7>wVwYaB%v$3_>n}~XI
zoXXn;+-Arc;I*2|8pH+MC6FV)JAx|mJmCeLmLtIIpS7zf3pj~$W+Q-TzLn@{<<$q+
zBIVQqZV}`TFyZF167xdN%2sB>fVAYb)hy(^Y;!gQ$Y>tfzmVI``LaPk8gmGt{NH_S
znPMn}eqEmJ1$=uB$Cdr}vCEWNz}f0-4@9OruOU{*ZDifq0C0+cROpqT7jo;^%d@+H
zXJa1usE~8AYqQ<JQwqomz2Yw7R&XuZs{k3uA-EE|hh3rUDdH|>tFk*mwkgl~WD$26
zw?2C%a8?3RqF<=&{}EfFtXu@1tj%5l_^KSPY+J;wfS7jyqUBQ%^RY#ojcd(z0+Pxh
zW@X#mtV8Kq46>WD9e~f~bWAZPL%((avNJE+Pz?Q&v+ZAKyR(?HnL^n%EjcX8F|msO
z2kaK5L{qmu+X}3C7nREwb9NYv7C>fG#NCTwFxF+80a=qbpe}~4wq%<CN#v3D7IQV)
zMq)lJaP%f>8DwcMDeMThoO%-;Ur>Y*uCeHOc+CBTR(pO)yVcu9xDlSXly)ifwOo~1
ze_Vg7zDZw5ze)dy9;98c`@F83k}|Cnh9uvG>WRug%%bJ}miGK#8rItU9~ObQoM{0m
zx$45Dh9;LU3N9qsoR`d322<yh8=7dIa=xgTX#!Dk;{~b|O$^q~^JTmlzb4Z(uYQ>;
zUvj;hn%6zcC9Uwk&EQ}t7KkO_Po?DQ%QKB2?QFYXiF1B0FQlL$ui!#;kfz{@vpajf
r26v_&G^}epzgjw{&*zJ(rhnr;YS$tDC5(Rwj!K{A)tBDq9G3qFOt0t>

delta 4927
zcma)Adw3L8makinuCD63RSB;=o36YFY)I3OB%K5pNJwY`iHQVoh&a$mD(N;!cjyNQ
zikRAg_*elAyLTLSXYd<G8Pr`cLajUaEi$fyE8{Q&`uSqO`E>l&Srv7i9T9O)RW+~K
zKX%ipuFCJ8bM866bMCpfa?if{d-m1uDav(I6!jilZ^BhZQE2@`bAz0l@^0ODsQ)g7
zp8@dlG3UgGikm5Qd@{l3w2EBx%4f2~_XEe|Co{qVdSbFpeFi&Dmb#fXL~<WtXHM|m
z6336-9%d0DFaDe>m<W4S^!h~9y9CutJni*5=#m_!l_viC*<zZycjB@)k9$WgXIdvV
zR8J$@4|BpqXkK?+3=2$&5Xq#Y>j#sG%&2mPlE5kJXKE!=Z4YHqTGAd*<uObUkwe31
zDhf`VnOBA8JnLgsCMcer;JX?oo4f87CwxB7<k_C`3YUC{qVXRn{0F5Mf_WPYW6Kbx
z#uhaR6Z>|#Z%ehb4@4Uh_21nx6pJri8SrmxNN;H^Z(G{jvw0|R)0Uw-n!1LA{@&H`
zaBq0?9V5QfP}R~kvG#CJ`%*2lHoUQBVZaxtt@it?12w9zp)u%dtnqn6zEDGbV4`sM
z3Up|q#P>|jSP^Z_>U3i)2thni_297ATU+a^4+hd&Ds6^m8}d~L8dQI6qu<vU42i%3
zt$aW!pDQ0s=5BaPDU}#Ex}rd1lem7ZH<B5N#N!x*ce!3C{3+(Z#8dlH5bq&z^7W?_
zb^*t-lz<eDF>f+Qn>WlM^TwKL65T?{Z{z2rU9PCuEEMy9cAVi3vVX%w=@u|kP8+it
zq{E!?RY>HW<)&AX+)ByM$(NO7@>|NgilLOrw<{0JyOj~S)%<`~iOiNW9f)`vBy}?O
z+M~#Ul&>h|D<gLU{i!nf)j3xVb5gu8$zON`fq0iNdEsL2bj6C|4NAGFe4+fO@_`}d
zplRm#v!d}v5mMMv2P+`BTQ`}pZkXl(6j;-<U3jj+pF(a^$0-?etI>-z`S=`~DqEvc
zKc#%Fe5rg&e8*5Fndd{Fg5YA8(Z2xgU`jZ~v~7ONjQNdemdP4M%0=+XK&tD4VqEM*
zq6z_h4c1KPGet24X>$&wT%wdqCi=NzT-uGCzMPojG0M5k+2h>gOgN*?h*5qFsfczQ
zAuTVWcS-qi)bDh>;P@xUe#c|Ry~oj?7%1WD5(k6m0E*eSsC^qWZ`06#^_Ow{Wz;M%
zF{fz8e42((e4HV^i7xW6Al@bXc{B)ETr}SO2+iZrNkh7T{_IgD`9VtAq5NKXT=|7E
zpoEp#iXgu#KP`VGKPboLPSA<T#)C8I&4{VQ`w6eo9W>q#@JgKPs-!(DwNz|4rp34B
z&7wmjXB#)&c&(bQqd{6HypLW)W8GNlqZ_e|84tQDUOB#JA#Lng$fN_zCRY{VN0~p;
zt|~Ab5+xT?K(F)%f;F}19V2un^DCAackM9vdl-yp*A5U$h=OCx$x^g{!p5!#m`&3d
zue6i!`<Pp4X(tGjO8H6+jC)Y{>YRl^mO`Pp?d9at%*{-(B;``dOUh=YTFR9V%B$sE
zd>U`X%cLJjtHH`=E+h9S^994Eq!%b6?cr<4f@92+<ZKRd!SJtL#tSEz@GlqzB?!NV
zO+m80G!hT7f9qv731Pw?V^`Bc*jRUr{SW7qT&9BVOb$lku~Z}-OT;0zwXd*Gt%2CU
zbCo+xyLK8!Rqli+I9XbtQJA{d*j>eCAbROxAQL2{hmE5??u^UHGqf%6!v);!jB{K%
zMJXRirwnm1_mbq`7y&x1@kTr6Wq_D*!gq01v@~u6y0~sBFNXzQt|O+Vh(#e}5i`Sh
zZXMSJO7d?BzX6ow-x`4p+>d15!O);nW4smTst_2x3_0UEXz8-CYLweA-I(4Q0_iO<
zDz<Uw=weAZ0LvYE*B_Mw%KOS$<qhT6$_eE~<$2{0bhG;va$q;t!=zl#0Eyg(K<vMY
z<nDjtoW|itxz1^2F7z>_xa6gH+;vENPjouZI{nNB`f>EJ{h>B<q+}oOBexvn9)%Qq
zZG3!)tA!p%F$x%SF^2!2xwjo;>mK&YBgZ&&q1thVlF>Gb`<}c5-!C1PDDfMyTIk~=
zd?EWJeU#2e+t8cnP3j1Bgq;Q^I+5Xi*6|)={QL;F39*7eEuARwH9K3zR7c(|ewutT
zfbz-j&e4ML4~FAqXs8s`0}^YDzULj4EcyH(_qDP3Fn1?35(Di)-_F~4!ExjQ&+cQk
zumcda^9z_|m>D0~>of-T3O}096f*VD!G&7DFVRN*Y2meY=U$pVPmeKo6Im6P7cwC>
z!d5U}GDqnqItTpy35uZ#>NvF*W-iUE(z^r-m6T9<MTqaxlBrlK4eOM2m5MWDVT0Z&
zQfN%DhDmOzxLS5L={JE!hXrxu-uHQx?9amrSzjvhm=Eb4Fxp@%94-~Bu_K_j12oTu
zJ}DJvW3E<T0Z^?Cm6nNBnDy$*1xlD>Lu<>#a?C8$+dyhQKoyAGS0)A#ZT!6|&PP(6
zzAS69LNHF0iS?4%Kfm=D-*$>f%|7Qq>-8AcH>A6KoH->L%qiD5>;Lz-DOHg}HV(UL
z1b?8;yUJVJsM@jJ(l3TZ8w=C{IHgql4tai13{SPeP@{SsZMg%ku+tu>ZzK=hCAi6H
z56&Ydo^Rs~jp~v_GN}z)%Uf-0Nm-*a?NQjs)s93wmQEyN@j*2c?^oLsgM%@$cu;K1
z`r-G3AF>A*S&CP{0Dw=<#4Y5`|Kb#)4!G*evnGR$>as*%bd#1GSeNnn2KokjBgr8x
zmR4skYa;K_vY&KSIEw04dHpqwYFj+54JKo0Q&g)-r&4{<OnR%DRZW8P@pL2>*OF@6
zNMum6z4vCP0@_+K$-Zb-I-1Nt5StQlTUK4E^=4wj{kF~($4yqp-MHq4Xn<DI;Rfcu
ze_9I9$Xc(5K(xqkI$FIXs`U-spa8Uz^Tk<CtRyyhO`b?GE+s#Sh~X?|($rjx%di<=
ze_yYb+#KnPl0}2!a>bmc$qRI~$F`b_;IW9<W~sGVrhZd|3rMCyve_*%rQ5t<Z}kYY
z>p^t{2<_JTl3Lo1&+@w4)NJe5;^`}ll2t`mz2;H3X@R(k@JzCKDC=dn=>z#?Auh2(
zTx8DF?S<TQk7}{LsCJdro{Twjsy_m2_F9JeV;V3$nn+nyl+BP8N4Hhia|>}9`8_TB
zth5()dm#g>M@=IsD_2)DOg`%qmsy3`?S+K2#^SxPIK*N}tw{`LMs73?`5|`|;9|?`
z0^4iIONSO8G=GzJ^`%Hj!sR9x2E;0hL!bzXzV(i@mW*paeQz?7jAacs*hb8X@9vA5
znS%B-Jgmhd@yPI&ly)uXt4?2EmR5;@eUsun`A|*2JjdJFyE0-Dy)Yja=Gnd_Rg=7C
zEeWf`n#n4RE5eWgayc&>pT$d$nci+~)b!ZON<XZNo3!*+&Emi+fgUr%YoN9EMThNK
z$OC!UO`x;nlYJwibC$o_SEGWHwe|2u;0@LW{Gl52pv}2fP<XENzSQD+#I*u?e1nTw
zp~uKc#^IY4xbiAt>INJA@HSEBZSeX1A^%vV9u=vAHZ&F{W5`iOe(b~Em7Qi)wLo~+
zA1~CAOe&=&>;nhHpv6l{w{5%aFO2)(J*CDQXb9AWd}GD>ph)Ef(O4V#Y?-5o%n#ul
zvN-MZkhv8OLAZL5B4dpXcjJwwAjXD9U&tG*4?&Er`hY-rJVF%`ny#u{eIV!0^3zp#
zSGr10Z9R}v=dY>#=`vljeE9d0|HFq!FW*l7JLH&Sbwu(=y<?vBG{r0|Xn3$VM@EOW
z5m=yP`)R4&ZR3!!j#ytZ0WVscVtrb5Q)VEU8L*RDXo~=u*>$}|?Mfy##US-o(z7O@
zSeoE9)m-^0yEszSs}e(IQ<=^{a*dLM%mLS=&vz?pu%{$?@%H;D=kJ_PIX5~3{44w}
zzS(iv@q}Z@F`v7{O>*nFx$H;mKeD~>^7;<5gZU1_(y!7F&^>eodILR*!icASL*1tw
zR~}FnD~x;sj^<17MSKj8<2F1+IxGE5%1BKTcD?NSq3d>6Q2bW>mH4pmp}0o$2pffG
zgq&LNs#V_zJL_85bMp`x%fs{WUj_A1*qK8%bRrMW!E+Ys36N^FH|uZma1hVFS&suW
zVnYk^aTr(D>mvY}`*#r{yYsOZ&uZ6)0qV1%SMqT)t_bKu0A-H{c?EbjF8AuU15{~C
ztti0dxNM;w11LM=odqysX`LPg$n*=$|4RX$i%UZKAVAsE$L9sO8mld4jiGK^s;Uq-
zVo$fO0kqMEHWmUsGn@5(fI4mH<w9JK-HY@-fZA+GEW)+8xJ~Z`Cf3`~iXyxS7d7Y+
zkn#gmiOAm-;d!`lk-h<>7TFN&8MQMCs`d3C<p!t>G4|%7#mUBET!`~m>EDB~A#02@
z731YNZ>fG8Sh(4SU;|r#XDrayfz%R!AlP%oIDn^D>$d__VMA^=Y-!W#^&Wt-jJLai
z@u{ozwE$&oshw`T0#9kuzYCCkf+J_$ID~WC^jiSB&6ZMULS#Ah`kHIDhGt@~tPJR@
z&Ew#7TkMIM_*N`0&{u(2)-mh>$8bpR1}K|_6&}cf<kMFIRAnoE--Bmi*DC#HfKoPe
z#DkY3(KwKUUv)eQN4cCMKFlxXN}(dp6KNECxSzq}e&QR&ozs5`k1xUX3S5uFbpo#Q
z#@<mpsxYO3O!#}S`5%SjPD8#A|7nerR<={hNo6}=DWzliUz@Z+K@?OV=Ks+SueDkG
QW%K&($rvX;#Wm{x0LADcD*ylh


From 7e89ffb6f1ea26eaecc73a720004c9dddfeaf22d Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Thu, 27 Nov 2025 23:51:04 +0100
Subject: [PATCH 3/7] XSS protection added to comments

---
 argocd/deployment.yaml                        |  2 +-
 .../templates/standards/standard_detail.html  | 32 +++++++++-
 dokumente/views.py                            | 60 +++++++++++++++----
 pages/templates/base.html                     |  2 +-
 4 files changed, 82 insertions(+), 14 deletions(-)

diff --git a/argocd/deployment.yaml b/argocd/deployment.yaml
index deb99fd..61ed7eb 100644
--- a/argocd/deployment.yaml
+++ b/argocd/deployment.yaml
@@ -25,7 +25,7 @@ spec:
               mountPath: /data
       containers:
         - name: web
-          image: git.baumann.gr/adebaumann/vui:0.958-comments
+          image: git.baumann.gr/adebaumann/vui:0.958-comments-XSS
           imagePullPolicy: Always
           ports:
             - containerPort: 8000
diff --git a/dokumente/templates/standards/standard_detail.html b/dokumente/templates/standards/standard_detail.html
index 033f96f..6f43da3 100644
--- a/dokumente/templates/standards/standard_detail.html
+++ b/dokumente/templates/standards/standard_detail.html
@@ -219,6 +219,36 @@
 
 <!-- JavaScript for Comments -->
 <script>
+// Content Security Policy for comment system
+document.addEventListener('DOMContentLoaded', function() {
+  // Prevent inline script execution in dynamically loaded content
+  const commentsContainer = document.getElementById('commentsContainer');
+  if (commentsContainer) {
+    // Use DOMPurify-like approach - only allow safe HTML
+    const allowedTags = ['br', 'small', 'div', 'span', 'button'];
+    const allowedAttributes = ['class', 'data-comment-id', 'aria-hidden'];
+    
+    // Monitor for any script injection attempts
+    const observer = new MutationObserver(function(mutations) {
+      mutations.forEach(function(mutation) {
+        mutation.addedNodes.forEach(function(node) {
+          if (node.nodeType === 1) { // Element node
+            const tagName = node.tagName.toLowerCase();
+            if (tagName === 'script') {
+              console.warn('Script injection attempt blocked');
+              node.parentNode.removeChild(node);
+            }
+          }
+        });
+      });
+    });
+    
+    observer.observe(commentsContainer, {
+      childList: true,
+      subtree: true
+    });
+  }
+});
 document.addEventListener('DOMContentLoaded', function() {
   let currentVorgabeId = null;
   let currentVorgabeNummer = null;
@@ -270,7 +300,7 @@ document.addEventListener('DOMContentLoaded', function() {
               <strong>${comment.user}</strong> 
               <small class="text-muted">(${comment.created_at})</small>
               ${comment.updated_at !== comment.created_at ? `<small class="text-muted">(bearbeitet: ${comment.updated_at})</small>` : ''}
-              <div class="mt-1">${comment.text.replace(/\n/g, '<br>')}</div>
+              <div class="mt-1">${comment.text}</div>
             </div>
             ${canDelete ? `
               <button class="btn btn-sm btn-outline-danger ml-2 delete-comment-btn" data-comment-id="${comment.id}">
diff --git a/dokumente/views.py b/dokumente/views.py
index 053973f..4a0835c 100644
--- a/dokumente/views.py
+++ b/dokumente/views.py
@@ -4,6 +4,8 @@ from django.http import JsonResponse
 from django.core.serializers.json import DjangoJSONEncoder
 from django.views.decorators.http import require_POST
 from django.views.decorators.csrf import csrf_exempt
+from django.utils.html import escape, mark_safe
+from django.utils.safestring import SafeString
 import json
 from .models import Dokument, Vorgabe, VorgabeKurztext, VorgabeLangtext, Checklistenfrage, VorgabeComment
 from abschnitte.utils import render_textabschnitte
@@ -264,16 +266,21 @@ def get_vorgabe_comments(request, vorgabe_id):
     
     comments_data = []
     for comment in comments:
+        # Escape HTML but preserve line breaks
+        escaped_text = escape(comment.text).replace('\n', '<br>')
         comments_data.append({
             'id': comment.id,
-            'text': comment.text,
-            'user': comment.user.username,
+            'text': escaped_text,
+            'user': escape(comment.user.username),
             'created_at': comment.created_at.strftime('%d.%m.%Y %H:%M'),
             'updated_at': comment.updated_at.strftime('%d.%m.%Y %H:%M'),
             'is_own': comment.user == request.user
         })
     
-    return JsonResponse({'comments': comments_data})
+    response = JsonResponse({'comments': comments_data})
+    response['Content-Security-Policy'] = "default-src 'self'"
+    response['X-Content-Type-Options'] = 'nosniff'
+    return response
 
 
 @require_POST
@@ -286,31 +293,53 @@ def add_vorgabe_comment(request, vorgabe_id):
         data = json.loads(request.body)
         text = data.get('text', '').strip()
         
+        # Validate input
         if not text:
             return JsonResponse({'error': 'Kommentar darf nicht leer sein'}, status=400)
         
+        if len(text) > 2000:  # Reasonable length limit
+            return JsonResponse({'error': 'Kommentar ist zu lang (max 2000 Zeichen)'}, status=400)
+        
+        # Additional XSS prevention - check for dangerous patterns
+        dangerous_patterns = ['<script', 'javascript:', 'onload=', 'onerror=', 'onclick=', 'onmouseover=']
+        text_lower = text.lower()
+        for pattern in dangerous_patterns:
+            if pattern in text_lower:
+                return JsonResponse({'error': 'Kommentar enthält ungültige Zeichen'}, status=400)
+        
         comment = VorgabeComment.objects.create(
             vorgabe=vorgabe,
             user=request.user,
             text=text
         )
         
-        return JsonResponse({
+        # Escape HTML but preserve line breaks
+        escaped_text = escape(comment.text).replace('\n', '<br>')
+        response = JsonResponse({
             'success': True,
             'comment': {
                 'id': comment.id,
-                'text': comment.text,
-                'user': comment.user.username,
+                'text': escaped_text,
+                'user': escape(comment.user.username),
                 'created_at': comment.created_at.strftime('%d.%m.%Y %H:%M'),
                 'updated_at': comment.updated_at.strftime('%d.%m.%Y %H:%M'),
                 'is_own': True
             }
         })
+    response['Content-Security-Policy'] = "default-src 'self'"
+    response['X-Content-Type-Options'] = 'nosniff'
+    return response
     
     except json.JSONDecodeError:
-        return JsonResponse({'error': 'Ungültige Daten'}, status=400)
+        response = JsonResponse({'error': 'Ungültige Daten'}, status=400)
+        response['Content-Security-Policy'] = "default-src 'self'"
+        response['X-Content-Type-Options'] = 'nosniff'
+        return response
     except Exception as e:
-        return JsonResponse({'error': str(e)}, status=500)
+        response = JsonResponse({'error': 'Serverfehler'}, status=500)
+        response['Content-Security-Policy'] = "default-src 'self'"
+        response['X-Content-Type-Options'] = 'nosniff'
+        return response
 
 
 @require_POST
@@ -321,10 +350,19 @@ def delete_vorgabe_comment(request, comment_id):
     
     # Check if user can delete this comment
     if comment.user != request.user and not request.user.is_staff:
-        return JsonResponse({'error': 'Keine Berechtigung zum Löschen dieses Kommentars'}, status=403)
+        response = JsonResponse({'error': 'Keine Berechtigung zum Löschen dieses Kommentars'}, status=403)
+        response['Content-Security-Policy'] = "default-src 'self'"
+        response['X-Content-Type-Options'] = 'nosniff'
+        return response
     
     try:
         comment.delete()
-        return JsonResponse({'success': True})
+        response = JsonResponse({'success': True})
+        response['Content-Security-Policy'] = "default-src 'self'"
+        response['X-Content-Type-Options'] = 'nosniff'
+        return response
     except Exception as e:
-        return JsonResponse({'error': str(e)}, status=500)
+        response = JsonResponse({'error': 'Serverfehler'}, status=500)
+        response['Content-Security-Policy'] = "default-src 'self'"
+        response['X-Content-Type-Options'] = 'nosniff'
+        return response
diff --git a/pages/templates/base.html b/pages/templates/base.html
index 15ad5e0..996daa6 100644
--- a/pages/templates/base.html
+++ b/pages/templates/base.html
@@ -215,7 +215,7 @@
           </p>
         </div>
         <div class="col-sm-6 text-right">
-          <p class="text-muted">Version {{ version|default:"0.957-xss" }}</p>
+          <p class="text-muted">Version {{ version|default:"0.958-comments-XSS" }}</p>
         </div>
       </div>
     </div>

From db9bd92036ac5966ee27cac409cc7bd8ff975eac Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Thu, 27 Nov 2025 23:57:35 +0100
Subject: [PATCH 4/7] Try/except-error fixed

---
 argocd/deployment.yaml    | 2 +-
 dokumente/views.py        | 8 ++++----
 pages/templates/base.html | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/argocd/deployment.yaml b/argocd/deployment.yaml
index 61ed7eb..2263fd4 100644
--- a/argocd/deployment.yaml
+++ b/argocd/deployment.yaml
@@ -25,7 +25,7 @@ spec:
               mountPath: /data
       containers:
         - name: web
-          image: git.baumann.gr/adebaumann/vui:0.958-comments-XSS
+          image: git.baumann.gr/adebaumann/vui:0.959
           imagePullPolicy: Always
           ports:
             - containerPort: 8000
diff --git a/dokumente/views.py b/dokumente/views.py
index 4a0835c..a413894 100644
--- a/dokumente/views.py
+++ b/dokumente/views.py
@@ -326,10 +326,10 @@ def add_vorgabe_comment(request, vorgabe_id):
                 'is_own': True
             }
         })
-    response['Content-Security-Policy'] = "default-src 'self'"
-    response['X-Content-Type-Options'] = 'nosniff'
-    return response
-    
+        response['Content-Security-Policy'] = "default-src 'self'"
+        response['X-Content-Type-Options'] = 'nosniff'
+        return response
+        
     except json.JSONDecodeError:
         response = JsonResponse({'error': 'Ungültige Daten'}, status=400)
         response['Content-Security-Policy'] = "default-src 'self'"
diff --git a/pages/templates/base.html b/pages/templates/base.html
index 996daa6..27b84a4 100644
--- a/pages/templates/base.html
+++ b/pages/templates/base.html
@@ -215,7 +215,7 @@
           </p>
         </div>
         <div class="col-sm-6 text-right">
-          <p class="text-muted">Version {{ version|default:"0.958-comments-XSS" }}</p>
+          <p class="text-muted">Version {{ version|default:"0.959" }}</p>
         </div>
       </div>
     </div>

From b579f5fb42fcd4e54a25b382df016ff5c8db3cea Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Fri, 28 Nov 2025 00:13:07 +0100
Subject: [PATCH 5/7] Admin interface for comments

---
 argocd/deployment.yaml | 2 +-
 dokumente/admin.py     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/argocd/deployment.yaml b/argocd/deployment.yaml
index 2263fd4..551a683 100644
--- a/argocd/deployment.yaml
+++ b/argocd/deployment.yaml
@@ -25,7 +25,7 @@ spec:
               mountPath: /data
       containers:
         - name: web
-          image: git.baumann.gr/adebaumann/vui:0.959
+          image: git.baumann.gr/adebaumann/vui:0.959.1
           imagePullPolicy: Always
           ports:
             - containerPort: 8000
diff --git a/dokumente/admin.py b/dokumente/admin.py
index 55733e5..4a0e923 100644
--- a/dokumente/admin.py
+++ b/dokumente/admin.py
@@ -293,6 +293,6 @@ class VorgabeAdmin(NestedModelAdmin):
 
 admin.site.register(Checklistenfrage)
 admin.site.register(Dokumententyp)
-#admin.site.register(Person)
+admin.site.register(VorgabeComment)
 
 #admin.site.register(Changelog)

From 048105ef27b18d8157a69015527d0513cb8494e9 Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Fri, 28 Nov 2025 09:55:35 +0100
Subject: [PATCH 6/7] Comment sorting changed, Comments added to test suite.

---
 Test Suite-DE.md          |  68 +++-
 Test suite.md             |  68 +++-
 argocd/deployment.yaml    |   2 +-
 dokumente/tests.py        | 668 +++++++++++++++++++++++++++++++++++++-
 dokumente/views.py        |   4 +-
 pages/templates/base.html |   2 +-
 6 files changed, 799 insertions(+), 13 deletions(-)

diff --git a/Test Suite-DE.md b/Test Suite-DE.md
index 071189c..92c697d 100644
--- a/Test Suite-DE.md	
+++ b/Test Suite-DE.md	
@@ -87,7 +87,7 @@ Die abschnitte App enthält 33 Tests, die Modelle, Utility-Funktionen, Diagram-C
 
 ## dokumente App Tests
 
-Die dokumente App enthält 98 Tests und ist damit die umfassendste Test-Suite, die alle Modelle, Views, URLs und Geschäftslogik abdeckt.
+Die dokumente App enthält 121 Tests und ist damit die umfassendste Test-Suite, die alle Modelle, Views, URLs, Geschäftslogik und Kommentarfunktionalität mit XSS-Schutz abdeckt.
 
 ### Modell-Tests
 
@@ -131,6 +131,14 @@ Die dokumente App enthält 98 Tests und ist damit die umfassendste Test-Suite, d
 - **test_checklistenfrage_str**: Überprüft, dass die String-Repräsentation lange Fragen kürzt
 - **test_checklistenfrage_related_name**: Testet die umgekehrte Beziehung von Vorgabe
 
+#### VorgabeCommentModelTest
+- **test_comment_creation**: Testet die Erstellung von VorgabeComment mit Vorgabe, Benutzer und Text
+- **test_comment_str**: Überprüft, dass die String-Repräsentation Benutzername und Vorgabennummer enthält
+- **test_comment_related_name**: Testet die umgekehrte Beziehung von Vorgabe
+- **test_comment_ordering**: Testet, dass Kommentare nach created_at absteigend sortiert sind (neueste zuerst)
+- **test_comment_timestamps_auto_update**: Testet, dass sich updated_at ändert, wenn ein Kommentar geändert wird
+- **test_multiple_users_can_comment**: Testet, dass mehrere Benutzer zur selben Vorgabe kommentieren können
+
 ### Text-Abschnitt-Tests
 
 #### DokumentTextAbschnitteTest
@@ -217,6 +225,40 @@ Die dokumente App enthält 98 Tests und ist damit die umfassendste Test-Suite, d
 - **test_vorgabe_links**: Testet, dass Vorgaben zu korrekten Admin-Seiten verlinken
 - **test_back_link**: Testet, dass der Zurück-Link zur Standardübersicht existiert
 
+### Kommentar-Funktionalität Tests
+
+#### GetVorgabeCommentsViewTest
+- **test_get_comments_requires_login**: Testet, dass anonyme Benutzer keine Kommentare sehen können und weitergeleitet werden
+- **test_regular_user_sees_only_own_comments**: Testet, dass normale Benutzer nur ihre eigenen Kommentare sehen
+- **test_staff_user_sees_all_comments**: Testet, dass Staff-Benutzer alle Kommentare sehen können
+- **test_get_comments_returns_404_for_nonexistent_vorgabe**: Testet 404-Antwort für nicht existierende Vorgabe
+- **test_comments_are_html_escaped**: Testet HTML-Escaping zur Verhinderung von XSS-Angriffen (z.B. `<script>`-Tags)
+- **test_line_breaks_preserved**: Testet, dass Zeilenumbrüche in `<br>`-Tags umgewandelt werden
+- **test_security_headers_present**: Testet, dass Content-Security-Policy und X-Content-Type-Options Header gesetzt sind
+
+#### AddVorgabeCommentViewTest
+- **test_add_comment_requires_login**: Testet, dass anonyme Benutzer keine Kommentare hinzufügen können
+- **test_add_comment_requires_post**: Testet, dass nur POST-Methode erlaubt ist (405 für GET)
+- **test_add_comment_success**: Testet erfolgreiche Kommentarerstellung mit gültigen Daten
+- **test_add_empty_comment_fails**: Testet, dass leere Kommentare mit 400-Fehler abgelehnt werden
+- **test_add_whitespace_only_comment_fails**: Testet, dass Kommentare nur mit Leerzeichen abgelehnt werden
+- **test_add_too_long_comment_fails**: Testet, dass Kommentare über 2000 Zeichen abgelehnt werden
+- **test_add_comment_xss_script_tag_blocked**: Testet, dass Kommentare mit `<script>`-Tags blockiert werden
+- **test_add_comment_xss_javascript_protocol_blocked**: Testet, dass `javascript:`-Protokoll blockiert wird
+- **test_add_comment_xss_event_handlers_blocked**: Testet, dass Event-Handler (onload, onerror, onclick, onmouseover) blockiert werden
+- **test_add_comment_invalid_json_fails**: Testet, dass ungültige JSON-Payloads abgelehnt werden
+- **test_add_comment_nonexistent_vorgabe_fails**: Testet 404-Antwort für nicht existierende Vorgabe
+- **test_add_comment_security_headers**: Testet, dass Sicherheits-Header in Antworten vorhanden sind
+
+#### DeleteVorgabeCommentViewTest
+- **test_delete_comment_requires_login**: Testet, dass anonyme Benutzer keine Kommentare löschen können
+- **test_delete_comment_requires_post**: Testet, dass nur POST-Methode erlaubt ist (405 für GET)
+- **test_user_can_delete_own_comment**: Testet, dass Benutzer ihre eigenen Kommentare löschen können
+- **test_user_cannot_delete_other_users_comment**: Testet, dass Benutzer keine Kommentare anderer löschen können (403 Forbidden)
+- **test_staff_can_delete_any_comment**: Testet, dass Staff-Benutzer jeden Kommentar löschen können
+- **test_delete_nonexistent_comment_returns_404**: Testet 404-Antwort für nicht existierenden Kommentar
+- **test_delete_comment_security_headers**: Testet, dass Sicherheits-Header in Antworten vorhanden sind
+
 ---
 
 ## pages App Tests
@@ -333,9 +375,17 @@ Die stichworte App enthält 18 Tests, die Schlüsselwortmodelle und ihre Sortier
 
 ## Test-Statistiken
 
-- **Gesamt-Tests**: 207
+- **Gesamt-Tests**: 230
 - **abschnitte**: 33 Tests (einschließlich XSS-Prävention)
-- **dokumente**: 116 Tests (98 in tests.py + 9 in test_json.py + 9 JSON-Tests in Haupt-tests.py)
+- **dokumente**: 121 Tests (einschließlich Kommentarfunktionalität mit XSS-Schutz)
+  - Modell-Tests: 44 Tests
+  - View-Tests: 7 Tests
+  - URL-Pattern-Tests: 4 Tests
+  - Sanity-Check-Tests: 16 Tests
+  - Management-Befehl-Tests: 2 Tests
+  - JSON-Export-Tests: 9 Tests
+  - Unvollständige-Vorgaben-Tests: 15 Tests
+  - Kommentar-Tests: 24 Tests (6 Modell + 18 View-Tests)
 - **pages**: 4 Tests
 - **referenzen**: 18 Tests
 - **rollen**: 18 Tests
@@ -349,7 +399,17 @@ Die stichworte App enthält 18 Tests, die Schlüsselwortmodelle und ihre Sortier
 4. **Utility-Funktionen**: Textverarbeitung, Caching, Formatierung
 5. **Management-Befehle**: CLI-Schnittstelle und Ausgabeverarbeitung
 6. **Integration**: App-übergreifende Funktionalität und Datenfluss
-7. **Sicherheit**: XSS-Prävention durch HTML-Bereinigung beim Rendern von Inhalten
+7. **Sicherheit**: 
+   - XSS-Prävention durch HTML-Bereinigung beim Rendern von Inhalten
+   - XSS-Angriffsverhinderung im Kommentarsystem (Script-Tags, javascript:-Protokoll, Event-Handler)
+   - Eingabevalidierung und -bereinigung
+   - Autorisierungsprüfungen (Staff vs. normale Benutzer)
+   - Sicherheits-Header (Content-Security-Policy, X-Content-Type-Options)
+8. **Kommentar-Funktionalität**:
+   - CRUD-Operationen (Create, Read, Delete)
+   - Benutzerberechtigungen und -besitz
+   - HTML-Escaping und Erhalt von Zeilenumbrüchen
+   - Verhinderung mehrerer XSS-Angriffsvektoren
 
 ## Ausführen der Tests
 
diff --git a/Test suite.md b/Test suite.md
index dda99a5..fc97ac8 100644
--- a/Test suite.md	
+++ b/Test suite.md	
@@ -87,7 +87,7 @@ The abschnitte app contains 33 tests covering models, utility functions, diagram
 
 ## dokumente App Tests
 
-The dokumente app contains 98 tests, making it the most comprehensive test suite, covering all models, views, URLs, and business logic.
+The dokumente app contains 121 tests, making it the most comprehensive test suite, covering all models, views, URLs, business logic, and comment functionality with XSS protection.
 
 ### Model Tests
 
@@ -131,6 +131,14 @@ The dokumente app contains 98 tests, making it the most comprehensive test suite
 - **test_checklistenfrage_str**: Verifies string representation truncates long questions
 - **test_checklistenfrage_related_name**: Tests the reverse relationship from Vorgabe
 
+#### VorgabeCommentModelTest
+- **test_comment_creation**: Tests VorgabeComment creation with vorgabe, user, and text
+- **test_comment_str**: Verifies string representation includes username and Vorgabennummer
+- **test_comment_related_name**: Tests the reverse relationship from Vorgabe
+- **test_comment_ordering**: Tests comments are ordered by created_at descending (newest first)
+- **test_comment_timestamps_auto_update**: Tests that updated_at changes when comment is modified
+- **test_multiple_users_can_comment**: Tests multiple users can comment on same Vorgabe
+
 ### Text Abschnitt Tests
 
 #### DokumentTextAbschnitteTest
@@ -217,6 +225,40 @@ The dokumente app contains 98 tests, making it the most comprehensive test suite
 - **test_vorgabe_links**: Tests Vorgaben link to correct admin pages
 - **test_back_link**: Tests back link to standard list exists
 
+### Comment Functionality Tests
+
+#### GetVorgabeCommentsViewTest
+- **test_get_comments_requires_login**: Tests anonymous users cannot view comments and are redirected
+- **test_regular_user_sees_only_own_comments**: Tests regular users only see their own comments
+- **test_staff_user_sees_all_comments**: Tests staff users can see all comments
+- **test_get_comments_returns_404_for_nonexistent_vorgabe**: Tests 404 response for non-existent Vorgabe
+- **test_comments_are_html_escaped**: Tests HTML escaping prevents XSS attacks (e.g., `<script>` tags)
+- **test_line_breaks_preserved**: Tests line breaks are converted to `<br>` tags
+- **test_security_headers_present**: Tests Content-Security-Policy and X-Content-Type-Options headers are set
+
+#### AddVorgabeCommentViewTest
+- **test_add_comment_requires_login**: Tests anonymous users cannot add comments
+- **test_add_comment_requires_post**: Tests only POST method is allowed (405 for GET)
+- **test_add_comment_success**: Tests successful comment creation with valid data
+- **test_add_empty_comment_fails**: Tests empty comments are rejected with 400 error
+- **test_add_whitespace_only_comment_fails**: Tests whitespace-only comments are rejected
+- **test_add_too_long_comment_fails**: Tests comments exceeding 2000 characters are rejected
+- **test_add_comment_xss_script_tag_blocked**: Tests comments with `<script>` tags are blocked
+- **test_add_comment_xss_javascript_protocol_blocked**: Tests `javascript:` protocol is blocked
+- **test_add_comment_xss_event_handlers_blocked**: Tests event handlers (onload, onerror, onclick, onmouseover) are blocked
+- **test_add_comment_invalid_json_fails**: Tests invalid JSON payloads are rejected
+- **test_add_comment_nonexistent_vorgabe_fails**: Tests 404 response for non-existent Vorgabe
+- **test_add_comment_security_headers**: Tests security headers are present in responses
+
+#### DeleteVorgabeCommentViewTest
+- **test_delete_comment_requires_login**: Tests anonymous users cannot delete comments
+- **test_delete_comment_requires_post**: Tests only POST method is allowed (405 for GET)
+- **test_user_can_delete_own_comment**: Tests users can delete their own comments
+- **test_user_cannot_delete_other_users_comment**: Tests users cannot delete others' comments (403 Forbidden)
+- **test_staff_can_delete_any_comment**: Tests staff users can delete any comment
+- **test_delete_nonexistent_comment_returns_404**: Tests 404 response for non-existent comment
+- **test_delete_comment_security_headers**: Tests security headers are present in responses
+
 ---
 
 ## pages App Tests
@@ -333,9 +375,17 @@ The stichworte app contains 18 tests covering keyword models and their ordering.
 
 ## Test Statistics
 
-- **Total Tests**: 207
+- **Total Tests**: 230
 - **abschnitte**: 33 tests (including XSS prevention)
-- **dokumente**: 116 tests (98 in tests.py + 9 in test_json.py + 9 JSON tests in main tests.py)
+- **dokumente**: 121 tests (including comment functionality with XSS protection)
+  - Model tests: 44 tests
+  - View tests: 7 tests
+  - URL pattern tests: 4 tests
+  - Sanity check tests: 16 tests
+  - Management command tests: 2 tests
+  - JSON export tests: 9 tests
+  - Incomplete Vorgaben tests: 15 tests
+  - Comment tests: 24 tests (6 model + 18 view tests)
 - **pages**: 4 tests
 - **referenzen**: 18 tests
 - **rollen**: 18 tests
@@ -349,7 +399,17 @@ The stichworte app contains 18 tests covering keyword models and their ordering.
 4. **Utility Functions**: Text processing, caching, formatting
 5. **Management Commands**: CLI interface and output handling
 6. **Integration**: Cross-app functionality and data flow
-7. **Security**: XSS prevention through HTML sanitization in content rendering
+7. **Security**: 
+   - XSS prevention through HTML sanitization in content rendering
+   - XSS attack prevention in comment system (script tags, javascript: protocol, event handlers)
+   - Input validation and sanitization
+   - Authorization checks (staff vs. regular users)
+   - Security headers (Content-Security-Policy, X-Content-Type-Options)
+8. **Comment Functionality**:
+   - CRUD operations (Create, Read, Delete)
+   - User permissions and ownership
+   - HTML escaping and line break preservation
+   - Multiple XSS attack vector prevention
 
 ## Running the Tests
 
diff --git a/argocd/deployment.yaml b/argocd/deployment.yaml
index 551a683..96a9392 100644
--- a/argocd/deployment.yaml
+++ b/argocd/deployment.yaml
@@ -25,7 +25,7 @@ spec:
               mountPath: /data
       containers:
         - name: web
-          image: git.baumann.gr/adebaumann/vui:0.959.1
+          image: git.baumann.gr/adebaumann/vui:0.960
           imagePullPolicy: Always
           ports:
             - containerPort: 8000
diff --git a/dokumente/tests.py b/dokumente/tests.py
index d7a3709..11cc550 100644
--- a/dokumente/tests.py
+++ b/dokumente/tests.py
@@ -7,7 +7,7 @@ from io import StringIO
 from .models import (
     Dokumententyp, Person, Thema, Dokument, Vorgabe,
     VorgabeLangtext, VorgabeKurztext, Geltungsbereich,
-    Einleitung, Checklistenfrage, Changelog
+    Einleitung, Checklistenfrage, Changelog, VorgabeComment
 )
 from .utils import check_vorgabe_conflicts, date_ranges_intersect, format_conflict_report
 from abschnitte.models import AbschnittTyp
@@ -1506,3 +1506,669 @@ class StandardJSONViewTest(TestCase):
         # Check that JSON is properly indented (should be formatted)
         self.assertIn('\n', response.content.decode())
         self.assertIn('  ', response.content.decode())  # Check for indentation
+
+
+class VorgabeCommentModelTest(TestCase):
+    """Test cases for VorgabeComment model"""
+    
+    def setUp(self):
+        """Set up test data for comment tests"""
+        self.user = User.objects.create_user(
+            username='testuser',
+            password='testpass123'
+        )
+        
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Test Typ",
+            verantwortliche_ve="Test VE"
+        )
+        
+        self.thema = Thema.objects.create(
+            name="Test Thema"
+        )
+        
+        self.dokument = Dokument.objects.create(
+            nummer="COMM-001",
+            dokumententyp=self.dokumententyp,
+            name="Comment Test Document",
+            aktiv=True
+        )
+        
+        self.vorgabe = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Test Vorgabe",
+            gueltigkeit_von=date.today()
+        )
+        
+        self.comment = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.user,
+            text="Dies ist ein Testkommentar"
+        )
+    
+    def test_comment_creation(self):
+        """Test that VorgabeComment is created correctly"""
+        self.assertEqual(self.comment.vorgabe, self.vorgabe)
+        self.assertEqual(self.comment.user, self.user)
+        self.assertEqual(self.comment.text, "Dies ist ein Testkommentar")
+        self.assertIsNotNone(self.comment.created_at)
+        self.assertIsNotNone(self.comment.updated_at)
+    
+    def test_comment_str(self):
+        """Test string representation of VorgabeComment"""
+        expected = f"Kommentar von {self.user.username} zu {self.vorgabe.Vorgabennummer()}"
+        self.assertEqual(str(self.comment), expected)
+    
+    def test_comment_related_name(self):
+        """Test related name works correctly"""
+        self.assertIn(self.comment, self.vorgabe.comments.all())
+    
+    def test_comment_ordering(self):
+        """Test comments are ordered by created_at descending"""
+        comment2 = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.user,
+            text="Zweiter Kommentar"
+        )
+        
+        comments = list(self.vorgabe.comments.all())
+        self.assertEqual(comments[0], comment2)  # Newest first
+        self.assertEqual(comments[1], self.comment)
+    
+    def test_comment_timestamps_auto_update(self):
+        """Test that updated_at changes when comment is modified"""
+        original_updated_at = self.comment.updated_at
+        
+        # Wait a tiny bit and update
+        import time
+        time.sleep(0.01)
+        
+        self.comment.text = "Updated text"
+        self.comment.save()
+        
+        self.assertNotEqual(self.comment.updated_at, original_updated_at)
+        self.assertEqual(self.comment.text, "Updated text")
+    
+    def test_multiple_users_can_comment(self):
+        """Test multiple users can comment on same Vorgabe"""
+        user2 = User.objects.create_user(
+            username='testuser2',
+            password='testpass123'
+        )
+        
+        comment2 = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=user2,
+            text="Kommentar von anderem Benutzer"
+        )
+        
+        self.assertEqual(self.vorgabe.comments.count(), 2)
+        self.assertIn(self.comment, self.vorgabe.comments.all())
+        self.assertIn(comment2, self.vorgabe.comments.all())
+
+
+class GetVorgabeCommentsViewTest(TestCase):
+    """Test cases for get_vorgabe_comments view"""
+    
+    def setUp(self):
+        """Set up test data"""
+        self.client = Client()
+        
+        # Create users
+        self.regular_user = User.objects.create_user(
+            username='regularuser',
+            password='testpass123'
+        )
+        
+        self.staff_user = User.objects.create_user(
+            username='staffuser',
+            password='testpass123'
+        )
+        self.staff_user.is_staff = True
+        self.staff_user.save()
+        
+        self.other_user = User.objects.create_user(
+            username='otheruser',
+            password='testpass123'
+        )
+        
+        # Create test data
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Test Typ",
+            verantwortliche_ve="Test VE"
+        )
+        
+        self.thema = Thema.objects.create(name="Test Thema")
+        
+        self.dokument = Dokument.objects.create(
+            nummer="COMM-001",
+            dokumententyp=self.dokumententyp,
+            name="Comment Test",
+            aktiv=True
+        )
+        
+        self.vorgabe = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Test Vorgabe",
+            gueltigkeit_von=date.today()
+        )
+        
+        # Create comments from different users
+        self.comment1 = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.regular_user,
+            text="Kommentar von Regular User"
+        )
+        
+        self.comment2 = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.other_user,
+            text="Kommentar von Other User"
+        )
+    
+    def test_get_comments_requires_login(self):
+        """Test that anonymous users cannot view comments"""
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        # Should redirect to login
+        self.assertEqual(response.status_code, 302)
+        self.assertIn('/login/', response.url)
+    
+    def test_regular_user_sees_only_own_comments(self):
+        """Test that regular users only see their own comments"""
+        self.client.login(username='regularuser', password='testpass123')
+        
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response['Content-Type'], 'application/json')
+        
+        import json
+        data = json.loads(response.content)
+        
+        # Should only see their own comment
+        self.assertEqual(len(data['comments']), 1)
+        self.assertEqual(data['comments'][0]['text'], 'Kommentar von Regular User')
+        self.assertEqual(data['comments'][0]['user'], 'regularuser')
+        self.assertTrue(data['comments'][0]['is_own'])
+    
+    def test_staff_user_sees_all_comments(self):
+        """Test that staff users see all comments"""
+        self.client.login(username='staffuser', password='testpass123')
+        
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        self.assertEqual(response.status_code, 200)
+        
+        import json
+        data = json.loads(response.content)
+        
+        # Should see all comments
+        self.assertEqual(len(data['comments']), 2)
+        usernames = [c['user'] for c in data['comments']]
+        self.assertIn('regularuser', usernames)
+        self.assertIn('otheruser', usernames)
+    
+    def test_get_comments_returns_404_for_nonexistent_vorgabe(self):
+        """Test that requesting comments for non-existent Vorgabe returns 404"""
+        self.client.login(username='regularuser', password='testpass123')
+        
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': 99999})
+        response = self.client.get(url)
+        
+        self.assertEqual(response.status_code, 404)
+    
+    def test_comments_are_html_escaped(self):
+        """Test that comments are properly HTML escaped"""
+        # Create comment with HTML
+        comment = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.regular_user,
+            text="Test <script>alert('xss')</script> comment"
+        )
+        
+        self.client.login(username='regularuser', password='testpass123')
+        
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        import json
+        data = json.loads(response.content)
+        
+        # Find the comment with script tag
+        script_comment = [c for c in data['comments'] if 'script' in c['text'].lower()][0]
+        
+        # Should be escaped
+        self.assertIn('&lt;script&gt;', script_comment['text'])
+        self.assertNotIn('<script>', script_comment['text'])
+    
+    def test_line_breaks_preserved(self):
+        """Test that line breaks are converted to <br> tags"""
+        comment = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.regular_user,
+            text="Line 1\nLine 2\nLine 3"
+        )
+        
+        self.client.login(username='regularuser', password='testpass123')
+        
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        import json
+        data = json.loads(response.content)
+        
+        # Find the multiline comment
+        multiline_comment = [c for c in data['comments'] if 'Line 1' in c['text']][0]
+        
+        # Should contain <br> tags
+        self.assertIn('<br>', multiline_comment['text'])
+        self.assertIn('Line 1<br>Line 2<br>Line 3', multiline_comment['text'])
+    
+    def test_security_headers_present(self):
+        """Test that security headers are present in response"""
+        self.client.login(username='regularuser', password='testpass123')
+        
+        url = reverse('get_vorgabe_comments', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        self.assertIn('Content-Security-Policy', response)
+        self.assertIn('X-Content-Type-Options', response)
+        self.assertEqual(response['X-Content-Type-Options'], 'nosniff')
+
+
+class AddVorgabeCommentViewTest(TestCase):
+    """Test cases for add_vorgabe_comment view"""
+    
+    def setUp(self):
+        """Set up test data"""
+        self.client = Client()
+        
+        self.user = User.objects.create_user(
+            username='testuser',
+            password='testpass123'
+        )
+        
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Test Typ",
+            verantwortliche_ve="Test VE"
+        )
+        
+        self.thema = Thema.objects.create(name="Test Thema")
+        
+        self.dokument = Dokument.objects.create(
+            nummer="COMM-001",
+            dokumententyp=self.dokumententyp,
+            name="Comment Test",
+            aktiv=True
+        )
+        
+        self.vorgabe = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Test Vorgabe",
+            gueltigkeit_von=date.today()
+        )
+    
+    def test_add_comment_requires_login(self):
+        """Test that anonymous users cannot add comments"""
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url, 
+            data='{"text": "Test comment"}',
+            content_type='application/json'
+        )
+        
+        # Should redirect to login
+        self.assertEqual(response.status_code, 302)
+    
+    def test_add_comment_requires_post(self):
+        """Test that only POST method is allowed"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.get(url)
+        
+        # Should return method not allowed
+        self.assertEqual(response.status_code, 405)
+    
+    def test_add_comment_success(self):
+        """Test successful comment addition"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='{"text": "Dies ist ein neuer Kommentar"}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 200)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertTrue(data['success'])
+        self.assertEqual(data['comment']['text'], 'Dies ist ein neuer Kommentar')
+        self.assertEqual(data['comment']['user'], 'testuser')
+        self.assertTrue(data['comment']['is_own'])
+        
+        # Verify comment was created in database
+        self.assertEqual(VorgabeComment.objects.count(), 1)
+        comment = VorgabeComment.objects.first()
+        self.assertEqual(comment.text, 'Dies ist ein neuer Kommentar')
+        self.assertEqual(comment.user, self.user)
+    
+    def test_add_empty_comment_fails(self):
+        """Test that empty comments are rejected"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='{"text": ""}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 400)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertIn('error', data)
+        self.assertIn('leer', data['error'].lower())
+        
+        # No comment should be created
+        self.assertEqual(VorgabeComment.objects.count(), 0)
+    
+    def test_add_whitespace_only_comment_fails(self):
+        """Test that whitespace-only comments are rejected"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='{"text": "   \\n\\t  "}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(VorgabeComment.objects.count(), 0)
+    
+    def test_add_too_long_comment_fails(self):
+        """Test that comments exceeding max length are rejected"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        long_text = "a" * 2001  # Over the 2000 character limit
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data=f'{{"text": "{long_text}"}}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 400)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertIn('error', data)
+        self.assertIn('lang', data['error'].lower())
+        
+        # No comment should be created
+        self.assertEqual(VorgabeComment.objects.count(), 0)
+    
+    def test_add_comment_xss_script_tag_blocked(self):
+        """Test that comments with <script> tags are blocked"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='{"text": "Test <script>alert(\\"xss\\")</script> comment"}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 400)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertIn('error', data)
+        self.assertIn('ungültige', data['error'].lower())
+        
+        # No comment should be created
+        self.assertEqual(VorgabeComment.objects.count(), 0)
+    
+    def test_add_comment_xss_javascript_protocol_blocked(self):
+        """Test that comments with javascript: protocol are blocked"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='{"text": "Click <a href=\\"javascript:alert(1)\\">here</a>"}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(VorgabeComment.objects.count(), 0)
+    
+    def test_add_comment_xss_event_handlers_blocked(self):
+        """Test that comments with event handlers are blocked"""
+        dangerous_inputs = [
+            'Test onload=alert(1) comment',
+            'Test onerror=alert(1) comment',
+            'Test onclick=alert(1) comment',
+            'Test onmouseover=alert(1) comment'
+        ]
+        
+        self.client.login(username='testuser', password='testpass123')
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        
+        for dangerous_input in dangerous_inputs:
+            response = self.client.post(url,
+                data=f'{{"text": "{dangerous_input}"}}',
+                content_type='application/json'
+            )
+            
+            self.assertEqual(response.status_code, 400)
+        
+        # No comments should be created
+        self.assertEqual(VorgabeComment.objects.count(), 0)
+    
+    def test_add_comment_invalid_json_fails(self):
+        """Test that invalid JSON is rejected"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='invalid json',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 400)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertIn('error', data)
+        self.assertIn('Ungültige', data['error'])
+    
+    def test_add_comment_nonexistent_vorgabe_fails(self):
+        """Test that adding comment to non-existent Vorgabe returns 404"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': 99999})
+        response = self.client.post(url,
+            data='{"text": "Test comment"}',
+            content_type='application/json'
+        )
+        
+        self.assertEqual(response.status_code, 404)
+    
+    def test_add_comment_security_headers(self):
+        """Test that security headers are present in response"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('add_vorgabe_comment', kwargs={'vorgabe_id': self.vorgabe.id})
+        response = self.client.post(url,
+            data='{"text": "Test comment"}',
+            content_type='application/json'
+        )
+        
+        self.assertIn('Content-Security-Policy', response)
+        self.assertIn('X-Content-Type-Options', response)
+        self.assertEqual(response['X-Content-Type-Options'], 'nosniff')
+
+
+class DeleteVorgabeCommentViewTest(TestCase):
+    """Test cases for delete_vorgabe_comment view"""
+    
+    def setUp(self):
+        """Set up test data"""
+        self.client = Client()
+        
+        self.user = User.objects.create_user(
+            username='testuser',
+            password='testpass123'
+        )
+        
+        self.other_user = User.objects.create_user(
+            username='otheruser',
+            password='testpass123'
+        )
+        
+        self.staff_user = User.objects.create_user(
+            username='staffuser',
+            password='testpass123'
+        )
+        self.staff_user.is_staff = True
+        self.staff_user.save()
+        
+        self.dokumententyp = Dokumententyp.objects.create(
+            name="Test Typ",
+            verantwortliche_ve="Test VE"
+        )
+        
+        self.thema = Thema.objects.create(name="Test Thema")
+        
+        self.dokument = Dokument.objects.create(
+            nummer="COMM-001",
+            dokumententyp=self.dokumententyp,
+            name="Comment Test",
+            aktiv=True
+        )
+        
+        self.vorgabe = Vorgabe.objects.create(
+            order=1,
+            nummer=1,
+            dokument=self.dokument,
+            thema=self.thema,
+            titel="Test Vorgabe",
+            gueltigkeit_von=date.today()
+        )
+        
+        self.comment = VorgabeComment.objects.create(
+            vorgabe=self.vorgabe,
+            user=self.user,
+            text="Test comment to delete"
+        )
+    
+    def test_delete_comment_requires_login(self):
+        """Test that anonymous users cannot delete comments"""
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': self.comment.id})
+        response = self.client.post(url)
+        
+        # Should redirect to login
+        self.assertEqual(response.status_code, 302)
+        
+        # Comment should still exist
+        self.assertTrue(VorgabeComment.objects.filter(id=self.comment.id).exists())
+    
+    def test_delete_comment_requires_post(self):
+        """Test that only POST method is allowed"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': self.comment.id})
+        response = self.client.get(url)
+        
+        # Should return method not allowed
+        self.assertEqual(response.status_code, 405)
+    
+    def test_user_can_delete_own_comment(self):
+        """Test that users can delete their own comments"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': self.comment.id})
+        response = self.client.post(url)
+        
+        self.assertEqual(response.status_code, 200)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertTrue(data['success'])
+        
+        # Comment should be deleted
+        self.assertFalse(VorgabeComment.objects.filter(id=self.comment.id).exists())
+    
+    def test_user_cannot_delete_other_users_comment(self):
+        """Test that users cannot delete other users' comments"""
+        self.client.login(username='otheruser', password='testpass123')
+        
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': self.comment.id})
+        response = self.client.post(url)
+        
+        self.assertEqual(response.status_code, 403)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertIn('error', data)
+        self.assertIn('Berechtigung', data['error'])
+        
+        # Comment should still exist
+        self.assertTrue(VorgabeComment.objects.filter(id=self.comment.id).exists())
+    
+    def test_staff_can_delete_any_comment(self):
+        """Test that staff users can delete any comment"""
+        self.client.login(username='staffuser', password='testpass123')
+        
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': self.comment.id})
+        response = self.client.post(url)
+        
+        self.assertEqual(response.status_code, 200)
+        
+        import json
+        data = json.loads(response.content)
+        
+        self.assertTrue(data['success'])
+        
+        # Comment should be deleted
+        self.assertFalse(VorgabeComment.objects.filter(id=self.comment.id).exists())
+    
+    def test_delete_nonexistent_comment_returns_404(self):
+        """Test that deleting non-existent comment returns 404"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': 99999})
+        response = self.client.post(url)
+        
+        self.assertEqual(response.status_code, 404)
+    
+    def test_delete_comment_security_headers(self):
+        """Test that security headers are present in response"""
+        self.client.login(username='testuser', password='testpass123')
+        
+        url = reverse('delete_vorgabe_comment', kwargs={'comment_id': self.comment.id})
+        response = self.client.post(url)
+        
+        self.assertIn('Content-Security-Policy', response)
+        self.assertIn('X-Content-Type-Options', response)
+        self.assertEqual(response['X-Content-Type-Options'], 'nosniff')
diff --git a/dokumente/views.py b/dokumente/views.py
index a413894..0b535dd 100644
--- a/dokumente/views.py
+++ b/dokumente/views.py
@@ -259,10 +259,10 @@ def get_vorgabe_comments(request, vorgabe_id):
     
     if request.user.is_staff:
         # Staff can see all comments
-        comments = vorgabe.comments.all().select_related('user')
+        comments = vorgabe.comments.all().select_related('user').order_by('created_at')
     else:
         # Regular users can only see their own comments
-        comments = vorgabe.comments.filter(user=request.user).select_related('user')
+        comments = vorgabe.comments.filter(user=request.user).select_related('user').order_by('created_at')
     
     comments_data = []
     for comment in comments:
diff --git a/pages/templates/base.html b/pages/templates/base.html
index 27b84a4..fd19f62 100644
--- a/pages/templates/base.html
+++ b/pages/templates/base.html
@@ -215,7 +215,7 @@
           </p>
         </div>
         <div class="col-sm-6 text-right">
-          <p class="text-muted">Version {{ version|default:"0.959" }}</p>
+          <p class="text-muted">Version {{ version|default:"0.960" }}</p>
         </div>
       </div>
     </div>

From 3a89f6d871d0fab058515faecd3b2cdd953734a7 Mon Sep 17 00:00:00 2001
From: "Adrian A. Baumann" <ade@adebaumann.com>
Date: Mon, 1 Dec 2025 10:55:46 +0100
Subject: [PATCH 7/7] Full name on comments

---
 dokumente/templates/standards/standard_detail.html | 2 +-
 dokumente/views.py                                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dokumente/templates/standards/standard_detail.html b/dokumente/templates/standards/standard_detail.html
index 6f43da3..38c2d54 100644
--- a/dokumente/templates/standards/standard_detail.html
+++ b/dokumente/templates/standards/standard_detail.html
@@ -297,7 +297,7 @@ document.addEventListener('DOMContentLoaded', function() {
         <div class="comment-item border-bottom pb-2 mb-2">
           <div class="d-flex justify-content-between align-items-start">
             <div class="flex-grow-1">
-              <strong>${comment.user}</strong> 
+              <strong>${comment.user}</strong>
               <small class="text-muted">(${comment.created_at})</small>
               ${comment.updated_at !== comment.created_at ? `<small class="text-muted">(bearbeitet: ${comment.updated_at})</small>` : ''}
               <div class="mt-1">${comment.text}</div>
diff --git a/dokumente/views.py b/dokumente/views.py
index 0b535dd..53e7b49 100644
--- a/dokumente/views.py
+++ b/dokumente/views.py
@@ -271,7 +271,7 @@ def get_vorgabe_comments(request, vorgabe_id):
         comments_data.append({
             'id': comment.id,
             'text': escaped_text,
-            'user': escape(comment.user.username),
+            'user': escape(comment.user.first_name+" "+comment.user.last_name),
             'created_at': comment.created_at.strftime('%d.%m.%Y %H:%M'),
             'updated_at': comment.updated_at.strftime('%d.%m.%Y %H:%M'),
             'is_own': comment.user == request.user