Bootstrap v2.2.0^2~40^2~6 changes this default to false, so this is a
prerequisite to upgrading Bootstrap, and it’s also safer.
This closes an HTML injection path via user full names in the emoji
reaction tooltip. It doesn’t appear to be exploitable for cross-site
scripting because we disallow `>` in full names, and the code happens
to be written such that the next `>` is in a different parser
invocation.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
perfect-scrollbar replaces both the appearance and the behavior of the
scrollbar, and its emulated behavior will never feel native on most
platforms. SimpleBar customizes the appearance while preserving the
native behavior.
Signed-off-by: Anders Kaseorg <andersk@mit.edu>
When guest user is subscribed to public stream, it throws json
error. Because when guest user is subscribed to public stream,
the `stream-sub-count` element is not initialized.
This commit fix this error, by editing the function
`rerender_subscribers_count` to intialize the element
first, when guest user is subscribed.
This commit add code to redirect guest users to
subscribed-stream-tab and removes the recently-unsubscribed
stream from settings tab on unsubscription.
This commit adds `stream_ui_updates.js` module. This module
will includes functions which will update different ui elements
(i.e. subscription button, subscriber count).
Anders Kaseorg
Anders Kaseorg
Yashashvi Dave