Sanitize your bio after you save it and render it to yourself.

discourse · Jan 16, 2014 · 09ed7fe · 09ed7fe
1 parent 7c8ea8c
commit 09ed7fe
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/assets/javascripts/discourse/controllers/preferences_controller.js b/app/assets/javascripts/discourse/controllers/preferences_controller.js
@@ -63,7 +63,7 @@ Discourse.PreferencesController = Discourse.ObjectController.extend({
         if (Discourse.User.currentProp('id') === model.get('id')) {
           Discourse.User.currentProp('name', model.get('name'));
         }
-        self.set('bio_cooked', Discourse.Markdown.cook(self.get('bio_raw')));
+        self.set('bio_cooked', Discourse.Markdown.cook(Discourse.Markdown.sanitize(self.get('bio_raw'))));
         self.set('saved', true);
       }, function() {
         // model failed to save