localizer: escape placeholder replacement values in html output mode

2026-05-14 21:28:11 +02:00 · 2021-11-18 09:27:29 +01:00
parent e1dda082e0
commit 8bbae82caa
7 changed files with 40 additions and 17 deletions
@@ -302,12 +302,12 @@ export function uiNoteEditor(context) {
            userLink
                .append('a')
                .attr('class', 'user-info')
-                .html(user.display_name)
+                .text(user.display_name)
                .attr('href', osm.userURL(user.display_name))
                .attr('target', '_blank');

            prose
-                .html(t.html('note.upload_explanation_with_user', { user: userLink.html() }));
+                .html(t.html('note.upload_explanation_with_user', { user: { html: userLink.html() } }));
        });
    }