Skip to content

Implement workaround for #602 (raw HTML in chat preview)

Chris Oelmueller requested to merge bugfix/602-chat-umlauts into master

Closes #602 (closed)

What does this MR do?

Provides a frontend solution to a backend issue. What could go wrong 😀 Basically, the encoded HTML content is directly injected into the website. This renders specially encoded characters correctly. It might also open a can of worms if users send malicious messages, so we try to prevent rendering any such content.

How confident are you it won't break things if deployed?

not gonna break: very confident

not introduce possible security loopholes in the future: uh, well... hopefully?

Links to related issues

https://yunity.slack.com/archives/C1T1ZM9A4/p1585594023082800

How to test

Steps a reviewer can take to verify that this MR does what it says it does e.g.

  1. Checkout branch locally
  2. Login as foodsaver
  3. Send message containing äöüß–ÄÖÜẞ to another user
  4. Check message preview to verify those characters are displayed
  5. Play around with other kinds of message content that should not be displayed and verify this as well

Checklist

  • added a test, or explain why one is not needed/possible...
  • no unrelated changes
  • asked someone for a code review
  • joined #foodsharing-beta channel at https://slackin.yunity.org
  • added an entry to CHANGELOG.md (description, merge request link, username(s))
  • Once your MR has been merged, you are responsible to update the #foodsharing-beta Slack channel about what has been changed here. They will test your work in different browsers, roles or other settings
Edited by Chris Oelmueller

Merge request reports