Merge pull request #7630 from RocketChat/hotfix/wrong-snippet-name

[FIX] Wrong render of snippet’s name
RocketChat · Aug 2, 2017 · de2cbc3 · de2cbc3
2 parents adda556 + 37ea7ac
commit de2cbc3
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/packages/rocketchat-message-snippet/client/messageType.js b/packages/rocketchat-message-snippet/client/messageType.js
@@ -4,7 +4,7 @@ Meteor.startup(function() {
 		system: true,
 		message: 'Snippeted_a_message',
 		data(message) {
-			const snippetLink = `<a href="/snippet/${ message.snippetId }/${ message.snippetName }">${ message.snippetName }</a>`;
+			const snippetLink = `<a href="/snippet/${ message.snippetId }/${ encodeURIComponent(message.snippetName) }">${ _.escapeHTML(message.snippetName) }</a>`;
 			return { snippetLink };
 		}
 	});

diff --git a/packages/rocketchat-message-snippet/client/tabBar/views/snippetMessage.js b/packages/rocketchat-message-snippet/client/tabBar/views/snippetMessage.js
@@ -13,6 +13,6 @@ Template.snippetMessage.helpers({
 		}
 	},
 	body() {
-		return `<a href="/snippet/${ this._id }/${ this.snippetName }">${ this.snippetName }</a>`;
+		return `<a href="/snippet/${ this._id }/${ encodeURIComponent(this.snippetName) }">${ _.escapeHTML(this.snippetName) }</a>`;
 	}
 });