When someone replies to a message that started with a mention it displays the HTML as part of that reply.
For example, note the <a class="mention" href="/u/simon_tomes">@simon_tomes</a> part of the reply.
I’d expect it to just display @simon_tomes and then the rest of the original message.
6 лайков
Canapin
(Coin-coin le Canapin)
06.Март.2023 16:59:07
3
Thanks for the report Simon! Our code wizards are on it
1 лайк
Excellent, thanks! Go Code Wizards!
1 лайк
j.jaffeux
(Joffrey Jaffeux)
15.Апрель.2023 13:06:03
6
Hi, yes we are focused on shipping good support for threads and will improve this after, it’s 100% on our roadmap.
3 лайка
Firepup650
(Firepup Sixfifty)
30.Июнь.2023 18:55:42
7
In the chat, if you mention someone, have at least one message in between, and then have someone (or yourself) reply to the message with the mention, the reply will show something like <a class="mention" href="/u/firepup650">@Firepup650</a> instead of the mention. Including < and/or > in your message will become < and >. This seems to be a recent change, and seems a bit unintentional, because if your message is just a mention, it works fine, but any other text in the message will cause it to become HTML in replies.
4 лайка
I think this is the same as this open bug topic @Firepup650 , so I’ve slipped your post over here to keep the reports grouped together.
5 лайков
Firepup650
(Firepup Sixfifty)
30.Июнь.2023 19:33:07
9
This does seem to apply even if the mention isn’t at the beginning of the message, and it applies to group mentions as well.
2 лайка
This one appears to have regressed. I’ve just spotted a reply that includes HTML.
1 лайк
martin
(Martin Brennan)
12.Июль.2023 23:45:10
12
Thanks for the reports, the issue will be fixed by this commit:
main ← issue/fix-reply-edit-excerpt-rendering-chat
merged 11:44PM - 12 Jul 23 UTC
Followup to 58c8f91d9acf20bbd8d4ef3bd88ed719564769ec
It is now safe to render… the message excerpt as HTML since
it is no longer using text_entities: true in the server
PrettyText.excerpt call when creating the message excerpt
from the cooked HTML.
This will fix the issue of things like mentions showing
HTML code instead of the actual mention when replying,
and cannot be used to inject improper HTML like style tags
via XSS.
<img width="1108" alt="image" src="https://github.com/discourse/discourse/assets/920448/14401f44-70a4-4501-8bb8-8c3b3e386e30">
4 лайка