* origin/develop:
Update dependency v-click-outside to v2.1.5
Update dependency shelljs to v0.8.5
Update dependency portal-vue to v2.1.7
Update dependency lodash to v4.17.21
Update dependency karma-spec-reporter to v0.0.33
Update dependency karma-webpack to v4.0.2
Update dependency karma-sourcemap-loader to v0.3.8
Update dependency eslint-plugin-vue to v5.2.3
Update dependency chromedriver to v87.0.7
Update dependency @chenfengyuan/vue-qrcode to v1.0.2
Pin dependencies
Pin dependencies
Do not mute bot posts in notifications
Lint
Add renovate.json
Add bot indication to user icon on statuses
Mute bot posts
fix placeholder attachments opening new tab
* origin/develop: (169 commits)
Improve the user card for deactivated users
Update CHANGELOG.md
Update CHANGELOG.md
Allow canceling a follow request
Simple policy reasons for instance specific policies
entity_normalizer: Escape name when parsing user
Translated using Weblate (Spanish)
Translated using Weblate (Catalan)
Translated using Weblate (Korean)
Translated using Weblate (Japanese (ja_PEDANTIC))
Translated using Weblate (Indonesian)
Translated using Weblate (Esperanto)
Translated using Weblate (Vietnamese)
Translated using Weblate (Italian)
Translated using Weblate (Vietnamese)
Translated using Weblate (Indonesian)
Translated using Weblate (Italian)
Translated using Weblate (Vietnamese)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Simplified))
...
In January 2020 Pleroma backend stopped escaping HTML in display names
and passed that responsibility on frontends, compliant with Mastodon's
version of Mastodon API [1]. Pleroma-FE was subsequently modified to
escape the display name [2], however only in the "name_html" field. This
was fine however, since that's what the code rendering display names used.
However, 2 months ago an MR [3] refactoring the way the frontend does emoji
and mention rendering was merged. One of the things it did was moving away
from doing emoji rendering in the entity normalizer and use the unescaped
'user.name' in the rendering code, resulting in HTML injection being
possible again.
This patch escapes 'user.name' as well, as far as I can tell there is no
actual use for an unescaped display name in frontend code, especially
when it comes from MastoAPI, where it is not supposed to be HTML.
[1]: https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/1052
[2]: https://git.pleroma.social/pleroma/pleroma/-/merge_requests/2167
[3]: https://git.pleroma.social/pleroma/pleroma-fe/-/merge_requests/1392
* origin/develop:
Use proper setting name
Use cleaner instance config check for shoutbox setting
Make locale language cleaner
Don't shorten shoutbox to SB
Fix lint error
Update CHANGELOG.md
New option: Hide shoutbox
* origin/develop:
Use proper setting name
Use cleaner instance config check for shoutbox setting
Make locale language cleaner
Don't shorten shoutbox to SB
Fix lint error
Update CHANGELOG.md
New option: Hide shoutbox
