diff --git a/app/assets/javascripts/discourse/app/lib/sidebar/user/categories-section/category-section-link.js b/app/assets/javascripts/discourse/app/lib/sidebar/user/categories-section/category-section-link.js index c76a314caa5..1427b50bdf5 100644 --- a/app/assets/javascripts/discourse/app/lib/sidebar/user/categories-section/category-section-link.js +++ b/app/assets/javascripts/discourse/app/lib/sidebar/user/categories-section/category-section-link.js @@ -131,7 +131,7 @@ export default class CategorySectionLink { } get title() { - return this.category.description; + return this.category.description_text; } get text() { diff --git a/app/assets/javascripts/discourse/tests/acceptance/sidebar-user-categories-section-test.js b/app/assets/javascripts/discourse/tests/acceptance/sidebar-user-categories-section-test.js index 053df5081d7..704cf303a3f 100644 --- a/app/assets/javascripts/discourse/tests/acceptance/sidebar-user-categories-section-test.js +++ b/app/assets/javascripts/discourse/tests/acceptance/sidebar-user-categories-section-test.js @@ -615,7 +615,7 @@ acceptance("Sidebar - Logged on user - Categories Section", function (needs) { assert.strictEqual( query(`.sidebar-section-link[data-category-id="${category.id}"]`).title, - category.description, + category.description_text, "category description without HTML entity is used as the link's title" ); }); diff --git a/app/models/category.rb b/app/models/category.rb index 67573be37ec..c568107da45 100644 --- a/app/models/category.rb +++ b/app/models/category.rb @@ -388,7 +388,7 @@ class Category < ActiveRecord::Base @@cache_text ||= LruRedux::ThreadSafeCache.new(1000) @@cache_text.getset(self.description) do text = Nokogiri::HTML5.fragment(self.description).text.strip - Rack::Utils.escape_html(text).html_safe + ERB::Util.html_escape(text).html_safe end end diff --git a/spec/lib/category_badge_spec.rb b/spec/lib/category_badge_spec.rb index 3d36d1af035..3eada370f23 100644 --- a/spec/lib/category_badge_spec.rb +++ b/spec/lib/category_badge_spec.rb @@ -18,6 +18,6 @@ RSpec.describe CategoryBadge do c = Fabricate(:category, description: '\' <b id="x">') html = CategoryBadge.html_for(c) - expect(html).to include("title='' <b id="x">'") + expect(html).to include("title='' <b id="x">'") end end diff --git a/spec/models/category_spec.rb b/spec/models/category_spec.rb index 069f60023ab..73c501d1536 100644 --- a/spec/models/category_spec.rb +++ b/spec/models/category_spec.rb @@ -400,8 +400,8 @@ RSpec.describe Category do it "correctly generates text description as needed" do c = Category.new expect(c.description_text).to be_nil - c.description = "<hello test." - expect(c.description_text).to eq("<hello test.") + c.description = "<hello foo/bar." + expect(c.description_text).to eq("<hello foo/bar.") end end