diff --git a/app/assets/javascripts/admin/models/report.js.es6 b/app/assets/javascripts/admin/models/report.js.es6
index 21caf4aec53..d453dd04cc7 100644
--- a/app/assets/javascripts/admin/models/report.js.es6
+++ b/app/assets/javascripts/admin/models/report.js.es6
@@ -333,7 +333,7 @@ const Report = Discourse.Model.extend({
const formatedValue = () => {
const topicId = row[properties.id];
const href = Discourse.getURL(`/t/-/${topicId}`);
- return `${topicTitle}`;
+ return `${escapeExpression(topicTitle)}`;
};
return {
@@ -352,7 +352,7 @@ const Report = Discourse.Model.extend({
property: properties.title,
value: postTitle,
formatedValue:
- postTitle && href ? `${postTitle}` : "—"
+ postTitle && href ? `${escapeExpression(postTitle)}` : "—"
};
},
diff --git a/test/javascripts/models/report-test.js.es6 b/test/javascripts/models/report-test.js.es6
index 3f1dd7a40d6..3ba6a5198b0 100644
--- a/test/javascripts/models/report-test.js.es6
+++ b/test/javascripts/models/report-test.js.es6
@@ -402,9 +402,9 @@ QUnit.test("computed labels", assert => {
time_read: 287362,
note: "This is a long note",
topic_id: 2,
- topic_title: "Test topic",
+ topic_title: "Test topic ",
post_number: 3,
- post_raw: "This is the beginning of",
+ post_raw: "This is the beginning of ",
filesize: 582641
}
];
@@ -502,9 +502,9 @@ QUnit.test("computed labels", assert => {
const computedTopicLabel = topicLabel.compute(row);
assert.equal(
computedTopicLabel.formatedValue,
- "Test topic"
+ "Test topic <html>"
);
- assert.equal(computedTopicLabel.value, "Test topic");
+ assert.equal(computedTopicLabel.value, "Test topic ");
const postLabel = computedLabels[5];
assert.equal(postLabel.mainProperty, "post_raw");
@@ -514,9 +514,9 @@ QUnit.test("computed labels", assert => {
const computedPostLabel = postLabel.compute(row);
assert.equal(
computedPostLabel.formatedValue,
- "This is the beginning of"
+ "This is the beginning of <html>"
);
- assert.equal(computedPostLabel.value, "This is the beginning of");
+ assert.equal(computedPostLabel.value, "This is the beginning of ");
const filesizeLabel = computedLabels[6];
assert.equal(filesizeLabel.mainProperty, "filesize");
@@ -533,11 +533,11 @@ QUnit.test("computed labels", assert => {
const postLink = computedLabels[5].compute(row).formatedValue;
assert.equal(
postLink,
- "This is the beginning of"
+ "This is the beginning of <html>"
);
const topicLink = computedLabels[4].compute(row).formatedValue;
- assert.equal(topicLink, "Test topic");
+ assert.equal(topicLink, "Test topic <html>");
const userLink = computedLabels[0].compute(row).formatedValue;
assert.equal(