MDL-67637 core_message: only preview lastmessage text if safe to do so

If any html/script tags are found in the text() value, don't display it.
2020-01-08 12:31:09 +01:00
parent f914f99a76
commit 4e80934653
3 changed files with 6 additions and 3 deletions
@@ -223,7 +223,10 @@ function(
                // If that's not possible, we'll report it under the catch-all 'other media'.
                var messagePreview = $(lastMessage.text).text();
                if (messagePreview) {
-                    return messagePreview;
+                    // The text value of the message must have no html/script tags.
+                    if (messagePreview.indexOf('<') == -1) {
+                        return messagePreview;
+                    }
                }
            }