When someone replies to a message that started with a mention it displays the HTML as part of that reply.
For example, note the <a class="mention" href="/u/simon_tomes">@simon_tomes</a>
part of the reply.
I’d expect it to just display @simon_tomes
and then the rest of the original message.
6 Likes
Canapin
(Coin-coin le Canapin)
March 6, 2023, 4:59pm
3
Thanks for the report Simon! Our code wizards are on it
1 Like
Excellent, thanks! Go Code Wizards!
1 Like
Hi, yes we are focused on shipping good support for threads and will improve this after, it’s 100% on our roadmap.
3 Likes
Firepup650
(Firepup Sixfifty)
June 30, 2023, 6:55pm
7
In the chat, if you mention someone, have at least one message in between, and then have someone (or yourself) reply to the message with the mention, the reply will show something like <a class="mention" href="/u/firepup650">@Firepup650</a>
instead of the mention. Including <
and/or >
in your message will become <
and >
. This seems to be a recent change, and seems a bit unintentional, because if your message is just a mention, it works fine, but any other text in the message will cause it to become HTML in replies.
4 Likes
I think this is the same as this open bug topic @Firepup650 , so I’ve slipped your post over here to keep the reports grouped together.
5 Likes
Firepup650
(Firepup Sixfifty)
June 30, 2023, 7:33pm
9
This does seem to apply even if the mention isn’t at the beginning of the message, and it applies to group mentions as well.
2 Likes
This one appears to have regressed. I’ve just spotted a reply that includes HTML.
1 Like
martin
(Martin Brennan)
July 12, 2023, 11:45pm
12
Thanks for the reports, the issue will be fixed by this commit:
discourse:main
← discourse:issue/fix-reply-edit-excerpt-rendering-chat
opened 12:53AM - 12 Jul 23 UTC
Followup to 58c8f91d9acf20bbd8d4ef3bd88ed719564769ec
It is now safe to render… the message excerpt as HTML since
it is no longer using text_entities: true in the server
PrettyText.excerpt call when creating the message excerpt
from the cooked HTML.
This will fix the issue of things like mentions showing
HTML code instead of the actual mention when replying,
and cannot be used to inject improper HTML like style tags
via XSS.
<img width="1108" alt="image" src="https://github.com/discourse/discourse/assets/920448/14401f44-70a4-4501-8bb8-8c3b3e386e30">
4 Likes