diff --git a/apps/comments/js/commentstabview.js b/apps/comments/js/commentstabview.js index 8b20bac571b..11b33e9f0cc 100644 --- a/apps/comments/js/commentstabview.js +++ b/apps/comments/js/commentstabview.js @@ -198,20 +198,20 @@ displayTpl: function (item) { return '
  • ' + '' - + '
    ' + + ' data-user-display-name="' + escapeHTML(item.label) + '">
    ' + ' ' + escapeHTML(item.label) + '' + '
  • '; }, insertTpl: function (item) { return '' + '' - + '
    ' + + ' data-user-display-name="' + escapeHTML(item.label) + '">
    ' + ' ' + escapeHTML(item.label) + '' + ''; }, @@ -224,7 +224,7 @@ // passing the whole comments form would re-apply and request // avatars from the server $(je.target).find( - 'div[data-username="' + $el.find('[data-username]').data('username') + '"]' + 'span[data-username="' + $el.find('[data-username]').data('username') + '"]' ).parent(), editionMode ); @@ -486,11 +486,11 @@ }, _composeHTMLMention: function(uid, displayName) { - var avatar = '
    '; + + _.escape(displayName) + '">'; var isCurrentUser = (uid === OC.getCurrentUser().uid); diff --git a/apps/comments/tests/js/commentstabviewSpec.js b/apps/comments/tests/js/commentstabviewSpec.js index c90ad04e419..bd1353cc43d 100644 --- a/apps/comments/tests/js/commentstabviewSpec.js +++ b/apps/comments/tests/js/commentstabviewSpec.js @@ -309,7 +309,7 @@ describe('OCA.Comments.CommentsTabView tests', function() { expect(createStub.calledOnce).toEqual(false); expect($newCommentForm.find('.message').html()).toContain('Mention to User Name'); expect($newCommentForm.find('.message').text()).not.toContain('@'); // In this case the default behaviour is prevented by the