diff --git a/modules/live-comments/js/views/item.js b/modules/live-comments/js/views/item.js index bb30737..297ad9a 100644 --- a/modules/live-comments/js/views/item.js +++ b/modules/live-comments/js/views/item.js @@ -15,7 +15,14 @@ o2.Views.LiveCommentsWidgetItemView = ( function( $ ) { initialize: function() { }, - makeLongWordsShort: function( content, limit ) { + makeLongWordsShort: function( content, limit, stripHTML ) { + if ( stripHTML ) { + // Rendering the content in a div is safe here, as we'll add it to the DOM later anyway, and we trust WordPress to have sanitized it. + var div = document.createElement( 'div' ); + div.innerHTML = content; + content = div.textContent || div.innerText || content; + } + var contentArray = content.split( ' ' ); for ( var i=0; i < contentArray.length; i++ ) { if ( contentArray[i].length > limit ) { @@ -29,7 +36,7 @@ o2.Views.LiveCommentsWidgetItemView = ( function( $ ) { render: function() { var jsonifiedModel = this.model.toJSON(); - jsonifiedModel.title = this.makeLongWordsShort( jsonifiedModel.title, 15 ); + jsonifiedModel.title = this.makeLongWordsShort( jsonifiedModel.title, 15, true ); jsonifiedModel.author = o2.UserCache.getUserFor( this.model.attributes, 32 ); var titleForItem = jsonifiedModel.title, diff --git a/modules/live-comments/load.php b/modules/live-comments/load.php index 4687639..d440581 100644 --- a/modules/live-comments/load.php +++ b/modules/live-comments/load.php @@ -40,7 +40,7 @@ function live_item_templates() { <# if ( 'comment' === data.type ) { #> data-postid="{{ data.postID }}" <# } #> - >{{{ data.title }}} + >{{ data.title }}