diff --git a/apps/comments/js/commentstabview.js b/apps/comments/js/commentstabview.js
index 8b20bac571b..11b33e9f0cc 100644
--- a/apps/comments/js/commentstabview.js
+++ b/apps/comments/js/commentstabview.js
@@ -198,20 +198,20 @@
displayTpl: function (item) {
return '
'
+ ''
- + ''
+ + ' data-user-display-name="' + escapeHTML(item.label) + '">'
+ ' ' + escapeHTML(item.label) + ''
+ '';
},
insertTpl: function (item) {
return ''
+ ''
- + ''
+ + ' data-user-display-name="' + escapeHTML(item.label) + '">'
+ ' ' + escapeHTML(item.label) + ''
+ '';
},
@@ -224,7 +224,7 @@
// passing the whole comments form would re-apply and request
// avatars from the server
$(je.target).find(
- 'div[data-username="' + $el.find('[data-username]').data('username') + '"]'
+ 'span[data-username="' + $el.find('[data-username]').data('username') + '"]'
).parent(),
editionMode
);
@@ -486,11 +486,11 @@
},
_composeHTMLMention: function(uid, displayName) {
- var avatar = '';
+ + _.escape(displayName) + '">';
var isCurrentUser = (uid === OC.getCurrentUser().uid);
diff --git a/apps/comments/tests/js/commentstabviewSpec.js b/apps/comments/tests/js/commentstabviewSpec.js
index c90ad04e419..bd1353cc43d 100644
--- a/apps/comments/tests/js/commentstabviewSpec.js
+++ b/apps/comments/tests/js/commentstabviewSpec.js
@@ -309,7 +309,7 @@ describe('OCA.Comments.CommentsTabView tests', function() {
expect(createStub.calledOnce).toEqual(false);
expect($newCommentForm.find('.message').html()).toContain('Mention to User Name');
expect($newCommentForm.find('.message').text()).not.toContain('@');
// In this case the default behaviour is prevented by the