diff options
| author | Morris Jobke <hey@morrisjobke.de> | 2018-08-30 20:52:20 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-08-30 20:52:20 +0200 |
| commit | ab9672a32f1399cfadd73e5b79659b83af5909a2 (patch) | |
| tree | 3f6ef5a073139d952cc771553a63198a4555a5db /apps/comments | |
| parent | 25857c49008df3bbb799522c8c70b876ee396495 (diff) | |
| parent | 5ba881ba41ccfa7c2c5fa97c282f715147d70dd1 (diff) | |
| download | nextcloud-server-ab9672a32f1399cfadd73e5b79659b83af5909a2.tar.gz nextcloud-server-ab9672a32f1399cfadd73e5b79659b83af5909a2.zip | |
Merge pull request #10913 from nextcloud/do-not-parse-html-in-user-id-and-display-name
Do not parse HTML in user id and display name
Diffstat (limited to 'apps/comments')
| -rw-r--r-- | apps/comments/js/commentstabview.js | 36 |
1 files changed, 20 insertions, 16 deletions
diff --git a/apps/comments/js/commentstabview.js b/apps/comments/js/commentstabview.js index db38d055af4..8b20bac571b 100644 --- a/apps/comments/js/commentstabview.js +++ b/apps/comments/js/commentstabview.js @@ -195,22 +195,26 @@ }, sorter: function (q, items) { return items; } }, - displayTpl: '<li>' - + '<span class="avatar-name-wrapper">' - + '<div class="avatar" ' - + 'data-username="${id}"' // for avatars - + ' data-user="${id}"' // for contactsmenu - + ' data-user-display-name="${label}"></div>' - + ' <strong>${label}</strong>' - + '</span></li>', - insertTpl: '' - + '<span class="avatar-name-wrapper">' - + '<div class="avatar" ' - + 'data-username="${id}"' // for avatars - + ' data-user="${id}"' // for contactsmenu - + ' data-user-display-name="${label}"></div>' - + ' <strong>${label}</strong>' - + '</span>', + displayTpl: function (item) { + return '<li>' + + '<span class="avatar-name-wrapper">' + + '<div class="avatar" ' + + ' data-username="' + escapeHTML(item.id) + '"' // for avatars + + ' data-user="' + escapeHTML(item.id) + '"' // for contactsmenu + + ' data-user-display-name="' + escapeHTML(item.label) + '"></div>' + + ' <strong>' + escapeHTML(item.label) + '</strong>' + + '</span></li>'; + }, + insertTpl: function (item) { + return '' + + '<span class="avatar-name-wrapper">' + + '<div class="avatar" ' + + ' data-username="' + escapeHTML(item.id) + '"' // for avatars + + ' data-user="' + escapeHTML(item.id) + '"' // for contactsmenu + + ' data-user-display-name="' + escapeHTML(item.label) + '"></div>' + + ' <strong>' + escapeHTML(item.label) + '</strong>' + + '</span>'; + }, searchKey: "label" }); $target.on('inserted.atwho', function (je, $el) { |