From ed5a96341bfab2cf9c70be2f5c2a6fd5aa863e5c Mon Sep 17 00:00:00 2001
From: Konstantinos Sideris <sideris.konstantin@gmail.com>
Date: Fri, 22 Sep 2017 22:12:36 +0300
Subject: [PATCH] Properly handle html tags

---
 src/TimelineItem.cc | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/TimelineItem.cc b/src/TimelineItem.cc
index 92351d63..70fc113f 100644
--- a/src/TimelineItem.cc
+++ b/src/TimelineItem.cc
@@ -90,6 +90,7 @@ TimelineItem::TimelineItem(events::MessageEventType ty,
                 };
         }
 
+        body = body.toHtmlEscaped();
         body.replace(URL_REGEX, URL_HTML);
         generateTimestamp(timestamp);
 
@@ -230,7 +231,7 @@ TimelineItem::TimelineItem(const events::MessageEvent<msgs::Emote> &event,
 {
         init();
 
-        auto body        = event.content().body().trimmed().toHtmlEscaped();
+        auto body        = event.content().body().trimmed();
         auto timestamp   = QDateTime::fromMSecsSinceEpoch(event.timestamp());
         auto displayName = TimelineViewManager::displayName(event.sender());
         auto emoteMsg    = QString("* %1 %2").arg(displayName).arg(body);
@@ -241,6 +242,7 @@ TimelineItem::TimelineItem(const events::MessageEvent<msgs::Emote> &event,
                             descriptiveTime(QDateTime::fromMSecsSinceEpoch(event.timestamp())) };
 
         generateTimestamp(timestamp);
+        emoteMsg = emoteMsg.toHtmlEscaped();
         emoteMsg.replace(URL_REGEX, URL_HTML);
 
         if (with_sender) {
@@ -267,7 +269,7 @@ TimelineItem::TimelineItem(const events::MessageEvent<msgs::Text> &event,
 {
         init();
 
-        auto body        = event.content().body().trimmed().toHtmlEscaped();
+        auto body        = event.content().body().trimmed();
         auto timestamp   = QDateTime::fromMSecsSinceEpoch(event.timestamp());
         auto displayName = TimelineViewManager::displayName(event.sender());
 
@@ -279,6 +281,7 @@ TimelineItem::TimelineItem(const events::MessageEvent<msgs::Text> &event,
 
         generateTimestamp(timestamp);
 
+        body = body.toHtmlEscaped();
         body.replace(URL_REGEX, URL_HTML);
 
         if (with_sender) {