HTML entities not being parsed in featured topic title on profile

错误
1

HTML entities are not being parsed properly in featured topic titles in user profiles, i.e.

How to start building stuff for Discourse if you’re newbie (like myself)

See e.g. Profile - angus - Discourse Meta

6 个赞
2

One for @markvanlan perhaps?

7 个赞
4

I just merged a commit to fix this. Just an extra set of {}!

7 个赞
6

Are we sure this does not open us up to XSS problems if there is html code in the title of the topic?

6 个赞
7

I confirmed that fancy_title is escaped, and does not open us up to XSS issues. I had just assumed that was the case, so I appreciate the question.

9 个赞