Commit ec9ed965 authored by JC Brand's avatar JC Brand

Remove `{{message}}` interpolation.

It's not used and confuses people. Instead the message gets inserted via
`$.text`, to avoid injection attacks.
parent 1b264461
......@@ -344,7 +344,6 @@
'time': msg_time.format('hh:mm'),
'isodate': msg_time.format(),
'username': username,
'message': '',
'extra_classes': extra_classes
})
)).children('.chat-msg-content').first().text(text)
......
<div class="chat-message {{extra_classes}}" data-isodate="{{isodate}}">
<span class="chat-msg-author chat-msg-{{sender}}">{{time}} **{{username}} </span>
<span class="chat-msg-content">{{message}}</span>
<span class="chat-msg-content"><!-- message gets added here via renderMessage --></span>
</div>
<div class="chat-message {{extra_classes}}" data-isodate="{{isodate}}" data-msgid="{{msgid}}">
<span class="chat-msg-author chat-msg-{{sender}}">{{time}} {{username}}:&nbsp;</span>
<span class="chat-msg-content">{{message}}</span>
<span class="chat-msg-content"><!-- message gets added here via renderMessage --></span>
</div>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment