codeninjasllc/discourse
1
0
Fork 0
mirror of https://github.com/codeninjasllc/discourse.git synced 2024-11-23 23:58:31 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

SECURITY: topic titles can show up in user page unescaped when streamed in

Browse source
This commit is contained in:
Sam Saffron 2016-02-01 20:53:26 +11:00
parent 27aaed0aa5
commit 904e532439
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
app/assets/javascripts/discourse/models/user.js.es6
View file

@ -188,6 +188,7 @@ const User = RestModel.extend({
if ((this.get('stream.filter') || ua.action_type) !== ua.action_type) return;
if (!this.get('stream.filter') && !this.inAllStream(ua)) return;
ua.title = Discourse.Emoji.unescape(Handlebars.Utils.escapeExpression(ua.title));
const action = UserAction.collapseStream([UserAction.create(ua)]);
stream.set('itemsLoaded', stream.get('itemsLoaded') + 1);
stream.get('content').insertAt(0, action[0]);