FIX: Don't allow formatting in titles when quoting other topics

2025-02-06 03:18:23 +00:00 · 2017-01-09 14:52:45 -05:00 · 2017-01-09 14:52:45 -05:00 · 3b74c0e3b8
commit 3b74c0e3b8
parent d9146de080
1 changed files with 1 additions and 1 deletions
--- a/lib/pretty_text/helpers.rb
+++ b/lib/pretty_text/helpers.rb
@ -50,7 +50,7 @@ module PrettyText
      topic = Topic.find_by(id: topic_id)
      if topic && Guardian.new.can_see?(topic)
        {
-          title: topic.title,
+          title: Rack::Utils.escape_html(topic.title),
          href: topic.url
        }
      end