diff options
| author | Joas Schilling <coding@schilljs.com> | 2018-07-17 15:02:46 +0200 |
|---|---|---|
| committer | Daniel Calviño Sánchez <danxuliu@gmail.com> | 2018-08-28 18:57:07 +0200 |
| commit | 5ba881ba41ccfa7c2c5fa97c282f715147d70dd1 (patch) | |
| tree | c327e0e83a4ae74eca63112e6aa22564e56d76cd /apps/comments | |
| parent | 90581a44c03c72ef7126393adfab23178b30ae39 (diff) | |
| download | nextcloud-server-5ba881ba41ccfa7c2c5fa97c282f715147d70dd1.tar.gz nextcloud-server-5ba881ba41ccfa7c2c5fa97c282f715147d70dd1.zip | |
Do not parse HTML in user id and display name
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'apps/comments')
| -rw-r--r-- | apps/comments/js/commentstabview.js | 36 |
1 files changed, 20 insertions, 16 deletions
diff --git a/apps/comments/js/commentstabview.js b/apps/comments/js/commentstabview.js index db38d055af4..8b20bac571b 100644 --- a/apps/comments/js/commentstabview.js +++ b/apps/comments/js/commentstabview.js @@ -195,22 +195,26 @@ }, sorter: function (q, items) { return items; } }, - displayTpl: '<li>' - + '<span class="avatar-name-wrapper">' - + '<div class="avatar" ' - + 'data-username="${id}"' // for avatars - + ' data-user="${id}"' // for contactsmenu - + ' data-user-display-name="${label}"></div>' - + ' <strong>${label}</strong>' - + '</span></li>', - insertTpl: '' - + '<span class="avatar-name-wrapper">' - + '<div class="avatar" ' - + 'data-username="${id}"' // for avatars - + ' data-user="${id}"' // for contactsmenu - + ' data-user-display-name="${label}"></div>' - + ' <strong>${label}</strong>' - + '</span>', + displayTpl: function (item) { + return '<li>' + + '<span class="avatar-name-wrapper">' + + '<div class="avatar" ' + + ' data-username="' + escapeHTML(item.id) + '"' // for avatars + + ' data-user="' + escapeHTML(item.id) + '"' // for contactsmenu + + ' data-user-display-name="' + escapeHTML(item.label) + '"></div>' + + ' <strong>' + escapeHTML(item.label) + '</strong>' + + '</span></li>'; + }, + insertTpl: function (item) { + return '' + + '<span class="avatar-name-wrapper">' + + '<div class="avatar" ' + + ' data-username="' + escapeHTML(item.id) + '"' // for avatars + + ' data-user="' + escapeHTML(item.id) + '"' // for contactsmenu + + ' data-user-display-name="' + escapeHTML(item.label) + '"></div>' + + ' <strong>' + escapeHTML(item.label) + '</strong>' + + '</span>'; + }, searchKey: "label" }); $target.on('inserted.atwho', function (je, $el) { |