Sanatize and auto_link IRC messages

app/helpers/chat/messages_helper.rb

@@ -8,10 +8,10 @@ def last_message_timestamp_for_channel(channel)
       'No Messages'
     end
   end
-  
-  def message_date(message)    
+
+  def message_date(message)
     params[:last_date] = @since.to_date if @since && params[:last_date].nil?
-    
+
     if params[:last_date].nil? || params[:last_date] != message.recorded_at.to_date
       params[:last_date] = message.recorded_at.to_date
       message.recorded_at.strftime("%A, %B %d, %Y")
@@ -21,4 +21,12 @@ def message_date(message)
   def message_time(message)
     message.recorded_at.strftime("%I:%M %p")
   end
+
+  def message_body(message, highlight=nil)
+    body = sanitize(message.body)
+
+    body = highlight(body, highlight) if highlight
+
+    auto_link(body, :html => { :target => '_blank' }).html_safe
+  end
 end

app/views/chat/_recent.html.haml

@@ -8,4 +8,4 @@
     .message
       .handle= "#{message.handle.name}:"
       .body{:class => (defined?(full_body) ? 'full' : '')}
-        = auto_link(message.body, :html => { :target => '_blank' })
+        = message_body(message)

app/views/chat/messages/_display.html.haml

@@ -5,5 +5,5 @@
 %tr.message
   %td.handle= "#{message.handle.name}:"
   %td.body{ :class => ('action' if message.action?)}
-    = auto_link(highlight(message.body,params[:highlight].try(:split)), :html => { :target => '_blank' })
+    = message_body(message, params[:highlight].try(:split))
   %td.recorded_at= message_time message

app/views/chat/messages/_search_result.html.haml

@@ -1,5 +1,5 @@
 %tr.message
   %td.handle= "#{message.handle.name}:"
   %td.body{ :class => ('action' if message.action?)}
-    = auto_link(highlight(message.body,params[:search].split), :html => { :target => '_blank' })
+    = message_body(message, params[:search].split)
   %td.recorded_at= message_time message