[fifilura]

I have some recollection about filters defined by jinja macros opening up for SQL injections.

[fifilura]

And this would be fine if you could lock down arbitrary input in e.g. dropdowns, but it was still possible to input arbitrary strings even in a dropdown because of the choice of widget.