do not escape css

templates/profile.html

@@ -7,7 +7,9 @@
 {% block posthead %}
     {% if css %}
         <style>
-            {{ css.css }}
+            {% autoescape false %}
+                {{ css.css }}
+            {% endautoescape %}
         </style>
     {% endif %}
 {% endblock %}

webserver.py

@@ -107,8 +107,12 @@ def page_setcss():
         if user_id is None:
             abort(403)
             return
+        css = request.form.get("css", "")
+        if "<style" in css:
+            abort(400)
+            return
         if ccss is None:
-            ccss = db.CustomCSS(royal_id=user_id, css=request.form.get("css", ""))
+            ccss = db.CustomCSS(royal_id=user_id, css=css)
             db_session.add(ccss)
         else:
             ccss.css = request.form.get("css", "")