FIX: prevent iframe in expended quote

discourse · Oct 28, 2014 · 9b29a23 · SamSaffron · Oct 28, 2014 · ZogStriP
1 parent e7b39be
commit 9b29a23
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/app/assets/javascripts/discourse/views/post_view.js b/app/assets/javascripts/discourse/views/post_view.js
@@ -131,7 +131,9 @@ Discourse.PostView = Discourse.GroupedView.extend(Ember.Evented, {
       topicId = parseInt(topicId, 10);
 
       Discourse.ajax("/posts/by_number/" + topicId + "/" + postId).then(function (result) {
-        var parsed = $(result.cooked);
+        // slightly double escape the cooked html to prevent jQuery from unescaping it
+        var escaped = result.cooked.replace("&", "&amp;");
+        var parsed = $(escaped);
         parsed.replaceText(originalText, "<span class='highlighted'>" + originalText + "</span>");
         $blockQuote.showHtml(parsed, 'fast', finished);
       });