So the display name is properly filtered in messages, it's just following or having the name in one's notifications that causes the unfiltered name to be output.
@<script>alert("Tek");</script> The issue has been brought to attention. It would improve the Fedi experience of me and many others if we didn't have to see this on every page load. Thank you.
hm, @Steffen K9 ๐ฐ which Friendica version do you use? I see @<script>alert("Tek");</script> posts with his "nickname" but no popup at all (the web-console doesn't show any errors too). I'm using the latest develop version of Friendica.
This is Friendica, version 2023.04-1 that is running at the web location libranet.de. The database version is 1518/1518, the post update version is 1507/1507.
@Steffen K9 ๐ฐ @clacke: seeking ๐ธ๐ช๐ญ๐ฐ๐๐ I wasnโt able to reproduce the issue in the notification dropdown, I just fixed it in the notifications page. Can you please send me the HTML snippet of the dropdown so that I can submit a blind fix?
Wow, thank you everyone for this quick response, it's been impressive, and thank you @<script>alert("Tek");</script> for doing unusual things with your display name to uncover this. =)
@<script>alert("Tek");</script> The changes are already merged upstream, we haven't released them yet, but they are available on the develop, which @Steffen K9 ๐ฐ has pulled on libranet.de.
@<script>alert("Tek");</script> @Steffen K9 ๐ฐ I would like to do an anticipated release, alongside another fix that has yet to be merged, and we will do the regular announcement then, giving you the credit for the find.
Philipp Holzer
Unknown parent • •Philipp Holzer
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • — (Vienna) •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
in reply to Philipp Holzer • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • • •Nope, I'm wrong. Going to libranet.de/display/f1417ed3-2โฆ or friendica.philipp.info/displayโฆ in incognito mode doesn't cause the alert.
So the display name is properly filtered in messages, it's just following or having the name in one's notifications that causes the unfiltered name to be output.
Philipp Holzer
2023-05-14 09:34:26
clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
Unknown parent • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
Unknown parent • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • • •Philipp Holzer
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
in reply to Philipp Holzer • • •@Philipp Holzer libranet.de/friendica
@Steffen K9 ๐ฐ
Philipp Holzer
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • •Hypolite Petovan
in reply to Philipp Holzer • • •Philipp Holzer
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
Unknown parent • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
Unknown parent • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • • •Hypolite Petovan
Unknown parent • • •Hypolite Petovan
Unknown parent • • •Hypolite Petovan
Unknown parent • • •/pingcall?Hypolite Petovan
Unknown parent • • •Philipp Holzer
in reply to Hypolite Petovan • •Philipp Holzer
in reply to clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐ • •Hypolite Petovan
in reply to Philipp Holzer • • •Hypolite Petovan
Unknown parent • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
Unknown parent • • •Wow, thank you everyone for this quick response, it's been impressive, and thank you @<script>alert("Tek");</script> for doing unusual things with your display name to uncover this. =)
@Steffen K9 ๐ฐ @LinuxWalt (@lnxw48a1) {3EB165E0-5BB1-45D2-9E7D-93B31821F864} @๐๐ฎ๐ธ๐ผ๐ฏ :๐ณ๐ฟ๐ถ๐ฒ๐ป๐ฑ๐ถ๐ฐ๐ฎ: ๐ฆ๐น โ @Philipp Holzer @Hypolite Petovan @Michael Vogel
Hypolite Petovan
Unknown parent • • •develop, which @Steffen K9 ๐ฐ has pulled onlibranet.de.Hypolite Petovan
Unknown parent • • •clacke: exhausted pixie dream boy ๐ธ๐ช๐ญ๐ฐ๐๐
Unknown parent • • •@<script>alert("Tek");</script> I wasn't rickrolled (except voluntarily) and I'm not seeing alerts.
@Hypolite Petovan @Steffen K9 ๐ฐ