Commit ec9ed965 authored by JC Brand's avatar JC Brand

Remove `{{message}}` interpolation.

It's not used and confuses people. Instead the message gets inserted via
`$.text`, to avoid injection attacks.
parent 1b264461
...@@ -344,7 +344,6 @@ ...@@ -344,7 +344,6 @@
'time': msg_time.format('hh:mm'), 'time': msg_time.format('hh:mm'),
'isodate': msg_time.format(), 'isodate': msg_time.format(),
'username': username, 'username': username,
'message': '',
'extra_classes': extra_classes 'extra_classes': extra_classes
}) })
)).children('.chat-msg-content').first().text(text) )).children('.chat-msg-content').first().text(text)
......
<div class="chat-message {{extra_classes}}" data-isodate="{{isodate}}"> <div class="chat-message {{extra_classes}}" data-isodate="{{isodate}}">
<span class="chat-msg-author chat-msg-{{sender}}">{{time}} **{{username}} </span> <span class="chat-msg-author chat-msg-{{sender}}">{{time}} **{{username}} </span>
<span class="chat-msg-content">{{message}}</span> <span class="chat-msg-content"><!-- message gets added here via renderMessage --></span>
</div> </div>
<div class="chat-message {{extra_classes}}" data-isodate="{{isodate}}" data-msgid="{{msgid}}"> <div class="chat-message {{extra_classes}}" data-isodate="{{isodate}}" data-msgid="{{msgid}}">
<span class="chat-msg-author chat-msg-{{sender}}">{{time}} {{username}}:&nbsp;</span> <span class="chat-msg-author chat-msg-{{sender}}">{{time}} {{username}}:&nbsp;</span>
<span class="chat-msg-content">{{message}}</span> <span class="chat-msg-content"><!-- message gets added here via renderMessage --></span>
</div> </div>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment