From 54d83992b48487dac3f73a6ce8bbc836573e12ff Mon Sep 17 00:00:00 2001
From: Ryan Wyllie <ryan@moodle.com>
Date: Tue, 18 Oct 2016 07:26:53 +0000
Subject: [PATCH] MDL-56252 message: clean message text in message area

Remove the HTML tags from any message in the message area when updating
the last message on the contact otherwise the styling breaks and also
allows <script> tags to be added to the page.
---
 message/amd/build/message_area_contacts.min.js | 2 +-
 message/amd/src/message_area_contacts.js       | 3 +++
 message/classes/helper.php                     | 3 ++-
 theme/boost/scss/moodle/message.scss           | 2 ++
 theme/bootstrapbase/less/moodle/message.less   | 2 ++
 theme/bootstrapbase/style/moodle.css           | 3 +++
 6 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/message/amd/build/message_area_contacts.min.js b/message/amd/build/message_area_contacts.min.js
index f8b921982b4..ef07b75f996 100644
--- a/message/amd/build/message_area_contacts.min.js
+++ b/message/amd/build/message_area_contacts.min.js
@@ -1 +1 @@
-define(["jquery","core/ajax","core/templates","core/notification","core/custom_interaction_events","core/str","core_message/message_area_events"],function(a,b,c,d,e,f,g){function h(a){this.messageArea=a,this._init()}var i={CONTACT:"[data-region='contact']",CONTACTICONBLOCKED:"[data-region='contact-icon-blocked']",CONTACTS:"[data-region='contacts'][data-region-content='contacts']",CONTACTSAREA:"[data-region='contacts-area']",CONVERSATIONS:"[data-region='contacts'][data-region-content='conversations']",LASTMESSAGETEXT:"[data-region='last-message-text']",LASTMESSAGEUSER:"[data-region='last-message-user']",LOADINGICON:".loading-icon",MESSAGETEXT:"[data-region='message-text']",MESSAGINGAREA:"[data-region='messaging-area']",NOCONTACTS:"[data-region=no-contacts]",SEARCHBOX:"[data-region='search-box']",SEARCHRESULTSAREA:"[data-region='search-results-area']",SEARCHTEXTAREA:"[data-region='search-text-area']",SELECTEDVIEWCONVERSATION:"[data-action='view-contact-msg'].selected",SELECTEDVIEWPROFILE:"[data-action='view-contact-profile'].selected",SHOWMESSAGES:"[data-action='show-messages']",VIEWCONVERSATION:"[data-action='view-contact-msg']",VIEWPROFILE:"[data-action='view-contact-profile']"};return h.prototype._isLoadingConversations=!1,h.prototype._isLoadingContacts=!1,h.prototype._numContactsDisplayed=0,h.prototype._numContactsToRetrieve=20,h.prototype._numConversationsDisplayed=0,h.prototype._numConversationsToRetrieve=20,h.prototype._messageLength=60,h.prototype.messageArea=null,h.prototype._init=function(){e.define(this.messageArea.node,[e.events.activate,e.events.down,e.events.up]),this.messageArea.onCustomEvent(g.MESSAGESEARCHCANCELED,this._viewConversations.bind(this)),this.messageArea.onCustomEvent(g.USERSSEARCHCANCELED,this._viewContacts.bind(this)),this.messageArea.onCustomEvent(g.CONTACTSSELECTED,this._viewContacts.bind(this)),this.messageArea.onCustomEvent(g.CONVERSATIONDELETED,this._deleteConversation.bind(this)),this.messageArea.onCustomEvent(g.CONVERSATIONSSELECTED,this._viewConversations.bind(this)),this.messageArea.onCustomEvent(g.CONTACTSSELECTED,this._viewContacts.bind(this)),this.messageArea.onCustomEvent(g.MESSAGESDELETED,this._updateLastMessage.bind(this)),this.messageArea.onCustomEvent(g.MESSAGESENT,this._handleMessageSent.bind(this)),this.messageArea.onCustomEvent(g.CONTACTREMOVED,function(a,b){this._removeContact(i.CONTACTS,b)}.bind(this)),this.messageArea.onCustomEvent(g.CONTACTADDED,function(a,b){this._addContact(b)}.bind(this)),this.messageArea.onCustomEvent(g.CONTACTBLOCKED,function(a,b){this._blockContact(b)}.bind(this)),this.messageArea.onCustomEvent(g.CONTACTUNBLOCKED,function(a,b){this._unblockContact(b)}.bind(this)),this.messageArea.onCustomEvent(g.CHOOSEMESSAGESTODELETE,this._startDeleting.bind(this)),this.messageArea.onCustomEvent(g.CANCELDELETEMESSAGES,this._stopDeleting.bind(this)),this.messageArea.onDelegateEvent(e.events.activate,i.VIEWCONVERSATION,this._viewConversation.bind(this)),this.messageArea.onDelegateEvent(e.events.activate,i.VIEWPROFILE,this._viewContact.bind(this)),this.messageArea.onDelegateEvent(e.events.activate,i.SHOWMESSAGES,this._showMessagingArea.bind(this)),this.messageArea.onDelegateEvent(e.events.up,i.CONTACT,this._selectPreviousContact.bind(this)),this.messageArea.onDelegateEvent(e.events.down,i.CONTACT,this._selectNextContact.bind(this)),this.messageArea.onDelegateEvent(e.events.up,i.VIEWCONVERSATION,this._selectPreviousConversation.bind(this)),this.messageArea.onDelegateEvent(e.events.down,i.VIEWCONVERSATION,this._selectNextConversation.bind(this)),this.messageArea.onDelegateEvent("focus",i.SEARCHBOX,this._setSearching.bind(this)),this.messageArea.onDelegateEvent("blur",i.SEARCHBOX,this._clearSearching.bind(this)),e.define(this.messageArea.find(i.CONVERSATIONS),[e.events.scrollBottom]),e.define(this.messageArea.find(i.CONTACTS),[e.events.scrollBottom]),this.messageArea.onDelegateEvent(e.events.scrollBottom,i.CONVERSATIONS,this._loadConversations.bind(this)),this.messageArea.onDelegateEvent(e.events.scrollBottom,i.CONTACTS,this._loadContacts.bind(this)),this._numConversationsDisplayed=20},h.prototype._startDeleting=function(){this.messageArea.find(i.CONTACTSAREA).addClass("editing")},h.prototype._stopDeleting=function(){this.messageArea.find(i.CONTACTSAREA).removeClass("editing")},h.prototype._viewConversations=function(){0===this._numConversationsDisplayed&&this._loadConversations(),this.messageArea.find(i.CONTACTS).hide(),this.messageArea.find(i.CONVERSATIONS).show()},h.prototype._viewContacts=function(){0===this._numContactsDisplayed&&this._loadContacts(),this.messageArea.find(i.CONVERSATIONS).hide(),this.messageArea.find(i.CONTACTS).show()},h.prototype._handleMessageSent=function(a,b,c){this._viewConversations();var d=this._getUserNode(i.CONVERSATIONS,b);if(0===d.length){var e=this._getUserNode(i.CONTACTS,b);if(0===e.length&&(e=this._getUserNode(i.SEARCHRESULTSAREA,b)),0==e.length)return;d=e.clone(),d.attr("data-action","view-contact-msg"),this.messageArea.find(i.CONVERSATIONS+" "+i.NOCONTACTS).remove(),this._numConversationsDisplayed++}d.prependTo(this.messageArea.find(i.CONVERSATIONS)),this.messageArea.find(i.CONVERSATIONS).scrollTop(0),this._updateContactText(d,c,!0),this._setSelectedUser("[data-userid='"+b+"']")},h.prototype._loadConversations=function(){if(this._isLoadingConversations)return!1;this._isLoadingConversations=!0;var a=0;return c.render("core/loading",{}).then(function(a,b){return this._numConversationsDisplayed?c.appendNodeContents(this.messageArea.find(i.CONVERSATIONS),"<div style='text-align:center'>"+a+"</div>",b):c.replaceNodeContents(this.messageArea.find(i.CONVERSATIONS),"<div style='text-align:center'>"+a+"</div>",b),this._getItems("core_message_data_for_messagearea_conversations",this._numConversationsDisplayed,this._numConversationsToRetrieve)}.bind(this)).then(function(b){return a=b.contacts.length,b.isconversation=!0,c.render("core_message/message_area_contacts",b)}).then(function(b,d){this.messageArea.find(i.CONVERSATIONS+" "+i.LOADINGICON).remove(),a>0?(c.appendNodeContents(this.messageArea.find(i.CONVERSATIONS),b,d),this._numConversationsDisplayed+=this._numConversationsToRetrieve):this._numConversationsDisplayed||c.replaceNodeContents(this.messageArea.find(i.CONVERSATIONS),b,d),this._isLoadingConversations=!1}.bind(this)).fail(d.exception)},h.prototype._loadContacts=function(){if(this._isLoadingContacts)return!1;this._isLoadingContacts=!0;var a=0;return c.render("core/loading",{}).then(function(a,b){return this._numContactsDisplayed?c.appendNodeContents(this.messageArea.find(i.CONTACTS),"<div style='text-align:center'>"+a+"</div>",b):c.replaceNodeContents(this.messageArea.find(i.CONTACTS),"<div style='text-align:center'>"+a+"</div>",b),this._getItems("core_message_data_for_messagearea_contacts",this._numContactsDisplayed,this._numContactsToRetrieve)}.bind(this)).then(function(b){return a=b.contacts.length,b.isconversation=!1,c.render("core_message/message_area_contacts",b)}).then(function(b,d){this.messageArea.find(i.CONTACTS+" "+i.LOADINGICON).remove(),a>0?(c.appendNodeContents(this.messageArea.find(i.CONTACTS),b,d),this._numContactsDisplayed+=a):this._numContactsDisplayed||c.replaceNodeContents(this.messageArea.find(i.CONTACTS),b,d),this._isLoadingContacts=!1}.bind(this)).fail(d.exception)},h.prototype._viewConversation=function(b){this.messageArea.trigger(g.CANCELDELETEMESSAGES);var c=a(b.currentTarget).data("userid"),d=a(b.currentTarget).data("messageid"),e="[data-userid='"+c+"']";d&&(e="[data-messageid='"+d+"']"),this._setSelectedUser(e),this.messageArea.trigger(g.CONVERSATIONSELECTED,c),this.messageArea.find(i.SELECTEDVIEWPROFILE).removeClass("selected"),this._showMessagingArea()},h.prototype._viewContact=function(b){this.messageArea.trigger(g.CANCELDELETEMESSAGES);var c=a(b.currentTarget).data("userid");this._setSelectedUser("[data-userid='"+c+"']"),this.messageArea.trigger(g.CONTACTSELECTED,c),this.messageArea.find(i.SELECTEDVIEWCONVERSATION).removeClass("selected"),this._showMessagingArea()},h.prototype._getItems=function(a,c,d){var e=b.call([{methodname:a,args:{userid:this.messageArea.getCurrentUserId(),limitfrom:c,limitnum:d}}]);return e[0]},h.prototype._deleteConversation=function(a,b){this._removeContact(i.CONVERSATIONS,b),this._numConversationsDisplayed--,this._hideMessagingArea(),this._stopDeleting()},h.prototype._updateLastMessage=function(a,b,c){if(c){var d=this._getUserNode(i.CONVERSATIONS,b),e=c.find(i.MESSAGETEXT).text().trim(),f=!1;c.data("useridto")==b&&(f=!0),this._updateContactText(d,e,f)}this._stopDeleting()},h.prototype._addContact=function(){this.messageArea.find(i.CONTACTS).empty(),this._numContactsDisplayed=0,this._loadContacts()},h.prototype._removeContact=function(a,b){this._getUserNode(a,b).remove(),this._numContactsDisplayed--},h.prototype._blockContact=function(a){var b=this._getUserNode(i.CONTACTS,a);b.find(i.CONTACTICONBLOCKED).removeClass("hidden"),b=this._getUserNode(i.CONVERSATIONS,a),b.find(i.CONTACTICONBLOCKED).removeClass("hidden"),b=this._getUserNode(i.SEARCHRESULTSAREA,a),b.find(i.CONTACTICONBLOCKED).removeClass("hidden")},h.prototype._unblockContact=function(a){var b=this._getUserNode(i.CONTACTS,a);b.find(i.CONTACTICONBLOCKED).addClass("hidden"),b=this._getUserNode(i.CONVERSATIONS,a),b.find(i.CONTACTICONBLOCKED).addClass("hidden"),b=this._getUserNode(i.SEARCHRESULTSAREA,a),b.find(i.CONTACTICONBLOCKED).addClass("hidden")},h.prototype._getUserNode=function(a,b){return this.messageArea.find(a+" "+i.CONTACT+"[data-userid='"+b+"']")},h.prototype._setSelectedUser=function(a){this.messageArea.find(i.CONTACT).removeClass("selected"),this.messageArea.find(i.CONTACT+a).addClass("selected")},h.prototype._getContactText=function(a){return a.length>this._messageLength&&(a=a.substr(0,this._messageLength-3),a+="..."),a},h.prototype._updateContactText=function(a,b,c){b=this._getContactText(b),c?f.get_string("you","message").done(function(b){a.find(i.LASTMESSAGEUSER).empty().append(b)}).always(function(){a.find(i.LASTMESSAGETEXT).empty().append(b)}):(a.find(i.LASTMESSAGEUSER).empty(),a.find(i.LASTMESSAGETEXT).empty().append(b))},h.prototype._selectNextContact=function(b,c){var d=a(b.target).closest(i.CONTACT),e=d.next();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._selectPreviousContact=function(b,c){var d=a(b.target).closest(i.CONTACT),e=d.prev();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._selectNextConversation=function(b,c){var d=a(b.target).closest(i.VIEWCONVERSATION),e=d.next();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._selectPreviousConversation=function(b,c){var d=a(b.target).closest(i.VIEWCONVERSATION),e=d.prev();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._setSearching=function(){a(i.SEARCHTEXTAREA).addClass("searching")},h.prototype._clearSearching=function(){a(i.SEARCHTEXTAREA).removeClass("searching")},h.prototype._showMessagingArea=function(){this.messageArea.find(i.MESSAGINGAREA).removeClass("hide-messages").addClass("show-messages")},h.prototype._hideMessagingArea=function(){this.messageArea.find(i.MESSAGINGAREA).removeClass("show-messages").addClass("hide-messages")},h});
\ No newline at end of file
+define(["jquery","core/ajax","core/templates","core/notification","core/custom_interaction_events","core/str","core_message/message_area_events"],function(a,b,c,d,e,f,g){function h(a){this.messageArea=a,this._init()}var i={CONTACT:"[data-region='contact']",CONTACTICONBLOCKED:"[data-region='contact-icon-blocked']",CONTACTS:"[data-region='contacts'][data-region-content='contacts']",CONTACTSAREA:"[data-region='contacts-area']",CONVERSATIONS:"[data-region='contacts'][data-region-content='conversations']",LASTMESSAGETEXT:"[data-region='last-message-text']",LASTMESSAGEUSER:"[data-region='last-message-user']",LOADINGICON:".loading-icon",MESSAGETEXT:"[data-region='message-text']",MESSAGINGAREA:"[data-region='messaging-area']",NOCONTACTS:"[data-region=no-contacts]",SEARCHBOX:"[data-region='search-box']",SEARCHRESULTSAREA:"[data-region='search-results-area']",SEARCHTEXTAREA:"[data-region='search-text-area']",SELECTEDVIEWCONVERSATION:"[data-action='view-contact-msg'].selected",SELECTEDVIEWPROFILE:"[data-action='view-contact-profile'].selected",SHOWMESSAGES:"[data-action='show-messages']",VIEWCONVERSATION:"[data-action='view-contact-msg']",VIEWPROFILE:"[data-action='view-contact-profile']"};return h.prototype._isLoadingConversations=!1,h.prototype._isLoadingContacts=!1,h.prototype._numContactsDisplayed=0,h.prototype._numContactsToRetrieve=20,h.prototype._numConversationsDisplayed=0,h.prototype._numConversationsToRetrieve=20,h.prototype._messageLength=60,h.prototype.messageArea=null,h.prototype._init=function(){e.define(this.messageArea.node,[e.events.activate,e.events.down,e.events.up]),this.messageArea.onCustomEvent(g.MESSAGESEARCHCANCELED,this._viewConversations.bind(this)),this.messageArea.onCustomEvent(g.USERSSEARCHCANCELED,this._viewContacts.bind(this)),this.messageArea.onCustomEvent(g.CONTACTSSELECTED,this._viewContacts.bind(this)),this.messageArea.onCustomEvent(g.CONVERSATIONDELETED,this._deleteConversation.bind(this)),this.messageArea.onCustomEvent(g.CONVERSATIONSSELECTED,this._viewConversations.bind(this)),this.messageArea.onCustomEvent(g.CONTACTSSELECTED,this._viewContacts.bind(this)),this.messageArea.onCustomEvent(g.MESSAGESDELETED,this._updateLastMessage.bind(this)),this.messageArea.onCustomEvent(g.MESSAGESENT,this._handleMessageSent.bind(this)),this.messageArea.onCustomEvent(g.CONTACTREMOVED,function(a,b){this._removeContact(i.CONTACTS,b)}.bind(this)),this.messageArea.onCustomEvent(g.CONTACTADDED,function(a,b){this._addContact(b)}.bind(this)),this.messageArea.onCustomEvent(g.CONTACTBLOCKED,function(a,b){this._blockContact(b)}.bind(this)),this.messageArea.onCustomEvent(g.CONTACTUNBLOCKED,function(a,b){this._unblockContact(b)}.bind(this)),this.messageArea.onCustomEvent(g.CHOOSEMESSAGESTODELETE,this._startDeleting.bind(this)),this.messageArea.onCustomEvent(g.CANCELDELETEMESSAGES,this._stopDeleting.bind(this)),this.messageArea.onDelegateEvent(e.events.activate,i.VIEWCONVERSATION,this._viewConversation.bind(this)),this.messageArea.onDelegateEvent(e.events.activate,i.VIEWPROFILE,this._viewContact.bind(this)),this.messageArea.onDelegateEvent(e.events.activate,i.SHOWMESSAGES,this._showMessagingArea.bind(this)),this.messageArea.onDelegateEvent(e.events.up,i.CONTACT,this._selectPreviousContact.bind(this)),this.messageArea.onDelegateEvent(e.events.down,i.CONTACT,this._selectNextContact.bind(this)),this.messageArea.onDelegateEvent(e.events.up,i.VIEWCONVERSATION,this._selectPreviousConversation.bind(this)),this.messageArea.onDelegateEvent(e.events.down,i.VIEWCONVERSATION,this._selectNextConversation.bind(this)),this.messageArea.onDelegateEvent("focus",i.SEARCHBOX,this._setSearching.bind(this)),this.messageArea.onDelegateEvent("blur",i.SEARCHBOX,this._clearSearching.bind(this)),e.define(this.messageArea.find(i.CONVERSATIONS),[e.events.scrollBottom]),e.define(this.messageArea.find(i.CONTACTS),[e.events.scrollBottom]),this.messageArea.onDelegateEvent(e.events.scrollBottom,i.CONVERSATIONS,this._loadConversations.bind(this)),this.messageArea.onDelegateEvent(e.events.scrollBottom,i.CONTACTS,this._loadContacts.bind(this)),this._numConversationsDisplayed=20},h.prototype._startDeleting=function(){this.messageArea.find(i.CONTACTSAREA).addClass("editing")},h.prototype._stopDeleting=function(){this.messageArea.find(i.CONTACTSAREA).removeClass("editing")},h.prototype._viewConversations=function(){0===this._numConversationsDisplayed&&this._loadConversations(),this.messageArea.find(i.CONTACTS).hide(),this.messageArea.find(i.CONVERSATIONS).show()},h.prototype._viewContacts=function(){0===this._numContactsDisplayed&&this._loadContacts(),this.messageArea.find(i.CONVERSATIONS).hide(),this.messageArea.find(i.CONTACTS).show()},h.prototype._handleMessageSent=function(a,b,c){this._viewConversations();var d=this._getUserNode(i.CONVERSATIONS,b);if(0===d.length){var e=this._getUserNode(i.CONTACTS,b);if(0===e.length&&(e=this._getUserNode(i.SEARCHRESULTSAREA,b)),0==e.length)return;d=e.clone(),d.attr("data-action","view-contact-msg"),this.messageArea.find(i.CONVERSATIONS+" "+i.NOCONTACTS).remove(),this._numConversationsDisplayed++}d.prependTo(this.messageArea.find(i.CONVERSATIONS)),this.messageArea.find(i.CONVERSATIONS).scrollTop(0),this._updateContactText(d,c,!0),this._setSelectedUser("[data-userid='"+b+"']")},h.prototype._loadConversations=function(){if(this._isLoadingConversations)return!1;this._isLoadingConversations=!0;var a=0;return c.render("core/loading",{}).then(function(a,b){return this._numConversationsDisplayed?c.appendNodeContents(this.messageArea.find(i.CONVERSATIONS),"<div style='text-align:center'>"+a+"</div>",b):c.replaceNodeContents(this.messageArea.find(i.CONVERSATIONS),"<div style='text-align:center'>"+a+"</div>",b),this._getItems("core_message_data_for_messagearea_conversations",this._numConversationsDisplayed,this._numConversationsToRetrieve)}.bind(this)).then(function(b){return a=b.contacts.length,b.isconversation=!0,c.render("core_message/message_area_contacts",b)}).then(function(b,d){this.messageArea.find(i.CONVERSATIONS+" "+i.LOADINGICON).remove(),a>0?(c.appendNodeContents(this.messageArea.find(i.CONVERSATIONS),b,d),this._numConversationsDisplayed+=this._numConversationsToRetrieve):this._numConversationsDisplayed||c.replaceNodeContents(this.messageArea.find(i.CONVERSATIONS),b,d),this._isLoadingConversations=!1}.bind(this)).fail(d.exception)},h.prototype._loadContacts=function(){if(this._isLoadingContacts)return!1;this._isLoadingContacts=!0;var a=0;return c.render("core/loading",{}).then(function(a,b){return this._numContactsDisplayed?c.appendNodeContents(this.messageArea.find(i.CONTACTS),"<div style='text-align:center'>"+a+"</div>",b):c.replaceNodeContents(this.messageArea.find(i.CONTACTS),"<div style='text-align:center'>"+a+"</div>",b),this._getItems("core_message_data_for_messagearea_contacts",this._numContactsDisplayed,this._numContactsToRetrieve)}.bind(this)).then(function(b){return a=b.contacts.length,b.isconversation=!1,c.render("core_message/message_area_contacts",b)}).then(function(b,d){this.messageArea.find(i.CONTACTS+" "+i.LOADINGICON).remove(),a>0?(c.appendNodeContents(this.messageArea.find(i.CONTACTS),b,d),this._numContactsDisplayed+=a):this._numContactsDisplayed||c.replaceNodeContents(this.messageArea.find(i.CONTACTS),b,d),this._isLoadingContacts=!1}.bind(this)).fail(d.exception)},h.prototype._viewConversation=function(b){this.messageArea.trigger(g.CANCELDELETEMESSAGES);var c=a(b.currentTarget).data("userid"),d=a(b.currentTarget).data("messageid"),e="[data-userid='"+c+"']";d&&(e="[data-messageid='"+d+"']"),this._setSelectedUser(e),this.messageArea.trigger(g.CONVERSATIONSELECTED,c),this.messageArea.find(i.SELECTEDVIEWPROFILE).removeClass("selected"),this._showMessagingArea()},h.prototype._viewContact=function(b){this.messageArea.trigger(g.CANCELDELETEMESSAGES);var c=a(b.currentTarget).data("userid");this._setSelectedUser("[data-userid='"+c+"']"),this.messageArea.trigger(g.CONTACTSELECTED,c),this.messageArea.find(i.SELECTEDVIEWCONVERSATION).removeClass("selected"),this._showMessagingArea()},h.prototype._getItems=function(a,c,d){var e=b.call([{methodname:a,args:{userid:this.messageArea.getCurrentUserId(),limitfrom:c,limitnum:d}}]);return e[0]},h.prototype._deleteConversation=function(a,b){this._removeContact(i.CONVERSATIONS,b),this._numConversationsDisplayed--,this._hideMessagingArea(),this._stopDeleting()},h.prototype._updateLastMessage=function(a,b,c){if(c){var d=this._getUserNode(i.CONVERSATIONS,b),e=c.find(i.MESSAGETEXT).text().trim(),f=!1;c.data("useridto")==b&&(f=!0),this._updateContactText(d,e,f)}this._stopDeleting()},h.prototype._addContact=function(){this.messageArea.find(i.CONTACTS).empty(),this._numContactsDisplayed=0,this._loadContacts()},h.prototype._removeContact=function(a,b){this._getUserNode(a,b).remove(),this._numContactsDisplayed--},h.prototype._blockContact=function(a){var b=this._getUserNode(i.CONTACTS,a);b.find(i.CONTACTICONBLOCKED).removeClass("hidden"),b=this._getUserNode(i.CONVERSATIONS,a),b.find(i.CONTACTICONBLOCKED).removeClass("hidden"),b=this._getUserNode(i.SEARCHRESULTSAREA,a),b.find(i.CONTACTICONBLOCKED).removeClass("hidden")},h.prototype._unblockContact=function(a){var b=this._getUserNode(i.CONTACTS,a);b.find(i.CONTACTICONBLOCKED).addClass("hidden"),b=this._getUserNode(i.CONVERSATIONS,a),b.find(i.CONTACTICONBLOCKED).addClass("hidden"),b=this._getUserNode(i.SEARCHRESULTSAREA,a),b.find(i.CONTACTICONBLOCKED).addClass("hidden")},h.prototype._getUserNode=function(a,b){return this.messageArea.find(a+" "+i.CONTACT+"[data-userid='"+b+"']")},h.prototype._setSelectedUser=function(a){this.messageArea.find(i.CONTACT).removeClass("selected"),this.messageArea.find(i.CONTACT+a).addClass("selected")},h.prototype._getContactText=function(b){return b=a(document.createElement("div")).html(b).text(),b.length>this._messageLength&&(b=b.substr(0,this._messageLength-3),b+="..."),b},h.prototype._updateContactText=function(a,b,c){b=this._getContactText(b),c?f.get_string("you","message").done(function(b){a.find(i.LASTMESSAGEUSER).empty().append(b)}).always(function(){a.find(i.LASTMESSAGETEXT).empty().append(b)}):(a.find(i.LASTMESSAGEUSER).empty(),a.find(i.LASTMESSAGETEXT).empty().append(b))},h.prototype._selectNextContact=function(b,c){var d=a(b.target).closest(i.CONTACT),e=d.next();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._selectPreviousContact=function(b,c){var d=a(b.target).closest(i.CONTACT),e=d.prev();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._selectNextConversation=function(b,c){var d=a(b.target).closest(i.VIEWCONVERSATION),e=d.next();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._selectPreviousConversation=function(b,c){var d=a(b.target).closest(i.VIEWCONVERSATION),e=d.prev();e.focus(),c.originalEvent.preventDefault(),c.originalEvent.stopPropagation()},h.prototype._setSearching=function(){a(i.SEARCHTEXTAREA).addClass("searching")},h.prototype._clearSearching=function(){a(i.SEARCHTEXTAREA).removeClass("searching")},h.prototype._showMessagingArea=function(){this.messageArea.find(i.MESSAGINGAREA).removeClass("hide-messages").addClass("show-messages")},h.prototype._hideMessagingArea=function(){this.messageArea.find(i.MESSAGINGAREA).removeClass("show-messages").addClass("hide-messages")},h});
\ No newline at end of file
diff --git a/message/amd/src/message_area_contacts.js b/message/amd/src/message_area_contacts.js
index 0158a71b3c1..c1aa29e3483 100644
--- a/message/amd/src/message_area_contacts.js
+++ b/message/amd/src/message_area_contacts.js
@@ -546,6 +546,9 @@ define(['jquery', 'core/ajax', 'core/templates', 'core/notification', 'core/cust
          * @return {String} The altered text
          */
         Contacts.prototype._getContactText = function(text) {
+            // Remove the HTML tags to render the contact text.
+            text = $(document.createElement('div')).html(text).text();
+
             if (text.length > this._messageLength) {
                 text = text.substr(0, this._messageLength - 3);
                 text += '...';
diff --git a/message/classes/helper.php b/message/classes/helper.php
index 410ce6a7890..f9e8dd4ebd7 100644
--- a/message/classes/helper.php
+++ b/message/classes/helper.php
@@ -147,7 +147,8 @@ class helper {
         $data->messageid = null;
         if (isset($contact->smallmessage)) {
             $data->ismessaging = true;
-            $data->lastmessage = $contact->smallmessage;
+            // Strip the HTML tags from the message for displaying in the contact area.
+            $data->lastmessage = clean_param($contact->smallmessage, PARAM_NOTAGS);
             $data->useridfrom = $contact->useridfrom;
             if (isset($contact->messageid)) {
                 $data->messageid = $contact->messageid;
diff --git a/theme/boost/scss/moodle/message.scss b/theme/boost/scss/moodle/message.scss
index f92503e70d1..fc90303184d 100644
--- a/theme/boost/scss/moodle/message.scss
+++ b/theme/boost/scss/moodle/message.scss
@@ -473,6 +473,8 @@
                         position: relative;
 
                         .text {
+                            display: block;
+
                             p {
                                 margin: 0;
                             }
diff --git a/theme/bootstrapbase/less/moodle/message.less b/theme/bootstrapbase/less/moodle/message.less
index dcd99a3dd04..57fe568aedb 100644
--- a/theme/bootstrapbase/less/moodle/message.less
+++ b/theme/bootstrapbase/less/moodle/message.less
@@ -465,6 +465,8 @@
                         position: relative;
 
                         .text {
+                            display: block;
+
                             p {
                                 margin: 0;
                             }
diff --git a/theme/bootstrapbase/style/moodle.css b/theme/bootstrapbase/style/moodle.css
index 76a4b080f7e..35b1ae94f07 100644
--- a/theme/bootstrapbase/style/moodle.css
+++ b/theme/bootstrapbase/style/moodle.css
@@ -6190,6 +6190,9 @@ a.ygtvspacer:hover {
   border-radius: 4px;
   position: relative;
 }
+.messaging-area-container .messaging-area .messages-area .messages .message .content .text {
+  display: block;
+}
 .messaging-area-container .messaging-area .messages-area .messages .message .content .text p {
   margin: 0;
 }