Fix insufficient sanitization of report comments

2 years ago · b27f50da5a
parent e2009ced3a
commit b27f50da5a
1 changed files with 1 additions and 1 deletions
--- a/app/views/admin/reports/show.html.haml
+++ b/app/views/admin/reports/show.html.haml
@ -92,7 +92,7 @@
 %hr.spacer

 .speech-bubble
-  .speech-bubble__bubble= simple_format(@report.comment.presence || t('admin.reports.comment.none'))
+  .speech-bubble__bubble= simple_format(h(@report.comment.presence || t('admin.reports.comment.none')))
  .speech-bubble__owner
    - if @report.account.local?
      = admin_account_link_to @report.account