Anders Kaseorg 46e562f990 bootstrap: Change tooltip html default to false. ... Bootstrap v2.2.0^2~40^2~6 changes this default to false, so this is a prerequisite to upgrading Bootstrap, and it’s also safer. This closes an HTML injection path via user full names in the emoji reaction tooltip. It doesn’t appear to be exploitable for cross-site scripting because we disallow `>` in full names, and the code happens to be written such that the next `>` is in a different parser invocation. Signed-off-by: Anders Kaseorg <anders@zulipchat.com>		2019-09-19 20:53:10 -07:00
..
activity.html	templates: Abstract render_bundle behind a Jinja2 macro.	2019-09-17 16:06:33 -07:00
ad_hoc_query.html	Clean ad_hoc_query.html to use 4 space indentation.	2017-06-06 22:00:36 -07:00
realm_summary_table.html	activity: Extract most js from realm_summary_table to activity.js.	2019-06-14 10:20:59 -07:00
stats.html	bootstrap: Change tooltip html default to false.	2019-09-19 20:53:10 -07:00
support.html	templates: Abstract render_bundle behind a Jinja2 macro.	2019-09-17 16:06:33 -07:00