From 12f546d6e631af40557df381360d33e19409c784 Mon Sep 17 00:00:00 2001
From: Martin Raifer <martin@raifer.tech>
Date: Thu, 18 Nov 2021 15:36:35 +0100
Subject: [PATCH] escape raw osm usernames displayed in note comments

---
 modules/ui/note_comments.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/modules/ui/note_comments.js b/modules/ui/note_comments.js
index 7c11bae57..9fc9a64f4 100644
--- a/modules/ui/note_comments.js
+++ b/modules/ui/note_comments.js
@@ -53,15 +53,18 @@ export function uiNoteComments() {
                         .attr('href', osm.userURL(d.user))
                         .attr('target', '_blank');
                 }
-                selection
-                    .html(function(d) { return d.user || t.html('note.anonymous'); });
+                if (d.user) {
+                    selection.text(d.user);
+                } else {
+                    selection.html(t.html('note.anonymous'));
+                }
             });
 
         metadataEnter
             .append('div')
             .attr('class', 'comment-date')
             .html(function(d) {
-                return t('note.status.' + d.action, { when: localeDateString(d.date) });
+                return t.html('note.status.' + d.action, { when: localeDateString(d.date) });
             });
 
         mainEnter