Rosa Gutierrez 8722057545 Keep one escapeHTML, and make it safe in an attribute ...

There were two: the one in dom_helpers escaped through a text node, which
leaves double quotes alone, so it could not have closed the hole in the
link preview's img src.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

2026-09-11 21:10:57 +02:00

..

assets

Show admin toggle, but disable for current user

2025-12-08 22:53:11 -06:00

channels

Scope the unread rooms stream per user

2026-08-03 14:55:19 -07:00

controllers

Close live Action Cable connections on sign out (#268)

2026-08-31 18:21:16 -07:00

helpers

Harden message content filtering + bump thruster to 0.1.23 (#237)

2026-08-10 15:55:02 -07:00

javascript

Keep one escapeHTML, and make it safe in an attribute

2026-09-11 21:10:57 +02:00

jobs

Add IP-based user banning

2025-11-26 14:30:38 +00:00

models

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

views

Adjust to match in-house style

2026-08-11 13:42:48 +02:00