Limit listing's permitted markdown tags (#3882)

app/javascript/listings/elements/bodyMarkdown.jsx

@@ -10,17 +10,17 @@ const BodyMarkdown = ({ onChange, defaultValue }) => (
         id="body_markdown"
         name="classified_listing[body_markdown]"
         maxLength="400"
-        placeholder="400 characters max, 12 line break max, no images allowed"
+        placeholder="400 characters max, 12 line break max, no images allowed, *markdown is encouraged*"
         value={defaultValue}
         onInput={onChange}
       />
     </label>
   </div>
-)
+);
 
 BodyMarkdown.propTypes = {
   onChange: PropTypes.func.isRequired,
   defaultValue: PropTypes.string.isRequired,
-}
+};
 
 export default BodyMarkdown;

app/labor/markdown_parser.rb

@@ -79,7 +79,7 @@ class MarkdownParser
 
     renderer = Redcarpet::Render::HTMLRouge.new(hard_wrap: true, filter_html: false)
     markdown = Redcarpet::Markdown.new(renderer, REDCARPET_CONFIG)
-    allowed_tags = %w[strong abbr aside em p h1 h2 h3 h4 h5 h6 i u b code pre
+    allowed_tags = %w[strong abbr aside em p h4 h5 h6 i u b code pre
                       br ul ol li small sup sub a span hr blockquote kbd]
     allowed_attributes = %w[href strong em ref rel src title alt class]
     ActionController::Base.helpers.sanitize markdown.render(@content).html_safe,