diff --git a/client/components/main/editor.js b/client/components/main/editor.js index 1b770a8f1..24ba29281 100755 --- a/client/components/main/editor.js +++ b/client/components/main/editor.js @@ -272,10 +272,13 @@ function mySafeAttrValue(tag, name, value, cssFilter) { // then use your custom function if (tag === 'a' && name === 'href') { // only filter the value if starts with 'cbthunderlink:' or 'aodroplink' - if (/^thunderlink:/ig.test(value) || /^cbthunderlink:/ig.test(value) || /^aodroplink:/ig.test(value)) { + if ( + /^thunderlink:/gi.test(value) || + /^cbthunderlink:/gi.test(value) || + /^aodroplink:/gi.test(value) + ) { return value; - } - else { + } else { // use the default safeAttrValue function to process all non cbthunderlinks return sanitizeXss.safeAttrValue(tag, name, value, cssFilter); } @@ -283,7 +286,7 @@ function mySafeAttrValue(tag, name, value, cssFilter) { // use the default safeAttrValue function to process it return sanitizeXss.safeAttrValue(tag, name, value, cssFilter); } -}; +} // XXX I believe we should compute a HTML rendered field on the server that // would handle markdown and user mentions. We can simply have two @@ -298,7 +301,8 @@ Blaze.Template.registerHelper( const view = this; let content = Blaze.toHTML(view.templateContentBlock); const currentBoard = Boards.findOne(Session.get('currentBoard')); - if (!currentBoard) return HTML.Raw(sanitizeXss(content, { safeAttrValue: mySafeAttrValue })); + if (!currentBoard) + return HTML.Raw(sanitizeXss(content, { safeAttrValue: mySafeAttrValue })); const knowedUsers = currentBoard.members.map(member => { const u = Users.findOne(member.userId); if (u) {