about summary refs log tree commit diff
path: root/app/javascript
diff options
context:
space:
mode:
authorPaweł Ngei <github@alxd.org>2018-12-07 16:42:22 +0100
committerEugen Rochko <eugen@zeonfederated.com>2018-12-07 16:42:22 +0100
commit5c7f641565e8022c3d8d704e49b510a79e5f16ad (patch)
tree6e7bbe51c22eb73084007e2d175234bc8c9ccdee /app/javascript
parentd3547fa00580a03d1687316d56c32f407c0d9fe6 (diff)
Escape HTML in profile name preview in profile settings (#9446)
* fix non-escaped html in the profile settings

* provide a default profile text in case if there's no custom one

* update haml syntax

* simplify default profile name to username

* sanitize user-input html but display emojified icons
Diffstat (limited to 'app/javascript')
-rw-r--r--app/javascript/packs/public.js8
1 files changed, 6 insertions, 2 deletions
diff --git a/app/javascript/packs/public.js b/app/javascript/packs/public.js
index 36b1fd26b..6ba37c049 100644
--- a/app/javascript/packs/public.js
+++ b/app/javascript/packs/public.js
@@ -1,3 +1,4 @@
+import escapeTextContentForBrowser from 'escape-html';
 import loadPolyfills from '../mastodon/load_polyfills';
 import ready from '../mastodon/ready';
 import { start } from '../mastodon/common';
@@ -133,9 +134,12 @@ function main() {
 
   delegate(document, '#account_display_name', 'input', ({ target }) => {
     const name = document.querySelector('.card .display-name strong');
-
     if (name) {
-      name.innerHTML = emojify(target.value);
+      if (target.value) {
+        name.innerHTML = emojify(escapeTextContentForBrowser(target.value));
+      } else {
+        name.textContent = document.querySelector('#default_account_display_name').textContent;
+      }
     }
   });