zulip

Author	SHA1	Message	Date
Anders Kaseorg	68cfcd6446	CVE-2020-9444: Prevent reverse tabnabbing attacks. While we could fix this issue by changing the markdown processor, doing so is not a robust solution, because even a momentary bug in the markdown processor could allow cached messages that do not follow our security policy. This change ensures that even if our markdown processor has bugs that result in rendered content that does not properly follow our policy of using rel="noopener noreferrer" on links, we'll still do something reasonable. Co-authored-by: Tim Abbott <tabbott@zulipchat.com> Signed-off-by: Anders Kaseorg <anders@zulipchat.com>	2020-04-01 14:01:45 -07:00
Tim Abbott	56946dbddb	design: Fix missing rendered_markdown class on /me content. There may be a deeper issue that various JavaScript logic expects every message to have a `.message_content` element, but we definitely should have the `.rendered_markdown` class on any markdown content. Fixes #13634.	2020-01-08 13:46:27 -08:00
Anders Kaseorg	0c565f50be	templates: Use upstream Handlebars partials syntax. Signed-off-by: Anders Kaseorg <anders@zulipchat.com>	2019-07-12 21:11:14 -07:00
Anders Kaseorg	3c3471b720	templates: Rename .handlebars ↦ .hbs and - ↦ _. Tweaked by tabbott to avoid accidentally disabling the linter for handlebars templates. Signed-off-by: Anders Kaseorg <anders@zulipchat.com>	2019-07-12 21:11:03 -07:00