When someone replies to a message that started with a mention it displays the HTML as part of that reply.
For example, note the <a class="mention" href="/u/simon_tomes">@simon_tomes</a>
part of the reply.
I’d expect it to just display @simon_tomes
and then the rest of the original message.
6 „Gefällt mir“
Canapin
(Coin-coin le Canapin)
6. März 2023 um 16:59
3
Thanks for the report Simon! Our code wizards are on it
1 „Gefällt mir“
Excellent, thanks! Go Code Wizards!
1 „Gefällt mir“
j.jaffeux
(Joffrey Jaffeux)
15. April 2023 um 13:06
6
Hi, yes we are focused on shipping good support for threads and will improve this after, it’s 100% on our roadmap.
3 „Gefällt mir“
Firepup650
(Firepup Sixfifty)
30. Juni 2023 um 18:55
7
In the chat, if you mention someone, have at least one message in between, and then have someone (or yourself) reply to the message with the mention, the reply will show something like <a class="mention" href="/u/firepup650">@Firepup650</a>
instead of the mention. Including <
and/or >
in your message will become <
and >
. This seems to be a recent change, and seems a bit unintentional, because if your message is just a mention, it works fine, but any other text in the message will cause it to become HTML in replies.
4 „Gefällt mir“
I think this is the same as this open bug topic @Firepup650 , so I’ve slipped your post over here to keep the reports grouped together.
5 „Gefällt mir“
Firepup650
(Firepup Sixfifty)
30. Juni 2023 um 19:33
9
This does seem to apply even if the mention isn’t at the beginning of the message, and it applies to group mentions as well.
2 „Gefällt mir“
This one appears to have regressed. I’ve just spotted a reply that includes HTML.
1 „Gefällt mir“
martin
(Martin Brennan)
12. Juli 2023 um 23:45
12
Thanks for the reports, the issue will be fixed by this commit:
discourse:main
← discourse:issue/fix-reply-edit-excerpt-rendering-chat
opened 12:53AM - 12 Jul 23 UTC
Followup to 58c8f91d9acf20bbd8d4ef3bd88ed719564769ec
It is now safe to render… the message excerpt as HTML since
it is no longer using text_entities: true in the server
PrettyText.excerpt call when creating the message excerpt
from the cooked HTML.
This will fix the issue of things like mentions showing
HTML code instead of the actual mention when replying,
and cannot be used to inject improper HTML like style tags
via XSS.
<img width="1108" alt="image" src="https://github.com/discourse/discourse/assets/920448/14401f44-70a4-4501-8bb8-8c3b3e386e30">
4 „Gefällt mir“