Commit Graph

5 Commits

Author SHA1 Message Date
Gillian Pantaleon 7a943601bc messagebox: Add title-text for user profile on sender name and avatar.
A separate outer span with the title text needs to be added because:

(1) The default bootstrap popover behavior takes the title as the
popover title, if provided.
(2) We need to avoid having the title area be too big in the
me_message template.

Fixes #12769.

Co-Author-By: Vaibhav <vrongmeal@gmail.com>
2020-05-14 14:07:41 -07:00
Anders Kaseorg 68cfcd6446 CVE-2020-9444: Prevent reverse tabnabbing attacks.
While we could fix this issue by changing the markdown processor,
doing so is not a robust solution, because even a momentary bug in the
markdown processor could allow cached messages that do not follow our
security policy.

This change ensures that even if our markdown processor has bugs that
result in rendered content that does not properly follow our policy of
using rel="noopener noreferrer" on links, we'll still do something
reasonable.

Co-authored-by: Tim Abbott <tabbott@zulipchat.com>
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2020-04-01 14:01:45 -07:00
Rishi Gupta a93045c12d message view: Add keyboard shortcut to title for [More...]. 2019-07-20 14:39:15 -07:00
Anders Kaseorg 0c565f50be templates: Use upstream Handlebars partials syntax.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-07-12 21:11:14 -07:00
Anders Kaseorg 3c3471b720 templates: Rename *.handlebars ↦ *.hbs and - ↦ _.
Tweaked by tabbott to avoid accidentally disabling the linter for
handlebars templates.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-07-12 21:11:03 -07:00