Escape HTML instead of discarding it.

2017-11-18 14:43:41 +02:00 · 2017-11-18 14:43:41 +02:00 · 66e78c3ec4
commit 66e78c3ec4
parent 4647bcd6e6
2 changed files with 3 additions and 2 deletions
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@ -58,7 +58,8 @@ defmodule Pleroma.Web.CommonAPI.Utils do
  end

  def format_input(text, mentions, tags) do
-    HtmlSanitizeEx.strip_tags(text)
+    Phoenix.HTML.html_escape(text)
+    |> elem(1)
    |> Formatter.linkify
    |> String.replace("\n", "<br>\n")
    |> add_user_links(mentions)