diff options
| author | Joas Schilling <coding@schilljs.com> | 2018-07-17 16:02:46 +0300 |
|---|---|---|
| committer | Morris Jobke <hey@morrisjobke.de> | 2018-07-23 11:51:25 +0300 |
| commit | 9e7197cbccc35c9c763c64cfab651577cddf8be6 (patch) | |
| tree | 0a0d9785ce9be56d1c58721fa21eabf151216ced | |
| parent | ab7b4d25976d9a74c67d4034eab07ee972e1b67a (diff) | |
Do not parse HTML in user id and display name
Signed-off-by: Joas Schilling <coding@schilljs.com>
| -rw-r--r-- | apps/comments/js/commentstabview.js | 36 |
1 files changed, 20 insertions, 16 deletions
diff --git a/apps/comments/js/commentstabview.js b/apps/comments/js/commentstabview.js index 9e501b141a7..2d5923773f3 100644 --- a/apps/comments/js/commentstabview.js +++ b/apps/comments/js/commentstabview.js @@ -196,22 +196,26 @@ }, sorter: function (q, items) { return items; } }, - displayTpl: '<li>' - + '<span class="avatar-name-wrapper">' - + '<div class="avatar" ' - + 'data-username="${id}"' // for avatars - + ' data-user="${id}"' // for contactsmenu - + ' data-user-display-name="${label}"></div>' - + ' <strong>${label}</strong>' - + '</span></li>', - insertTpl: '' - + '<span class="avatar-name-wrapper">' - + '<div class="avatar" ' - + 'data-username="${id}"' // for avatars - + ' data-user="${id}"' // for contactsmenu - + ' data-user-display-name="${label}"></div>' - + ' <strong>${label}</strong>' - + '</span>', + displayTpl: function (item) { + return '<li>' + + '<span class="avatar-name-wrapper">' + + '<div class="avatar" ' + + ' data-username="' + escapeHTML(item.id) + '"' // for avatars + + ' data-user="' + escapeHTML(item.id) + '"' // for contactsmenu + + ' data-user-display-name="' + escapeHTML(item.label) + '"></div>' + + ' <strong>' + escapeHTML(item.label) + '</strong>' + + '</span></li>'; + }, + insertTpl: function (item) { + return '' + + '<span class="avatar-name-wrapper">' + + '<div class="avatar" ' + + ' data-username="' + escapeHTML(item.id) + '"' // for avatars + + ' data-user="' + escapeHTML(item.id) + '"' // for contactsmenu + + ' data-user-display-name="' + escapeHTML(item.label) + '"></div>' + + ' <strong>' + escapeHTML(item.label) + '</strong>' + + '</span>'; + }, searchKey: "label" }); $target.on('inserted.atwho', function (je, $el) { |