11import { isEmpty } from "@ember/utils" ;
2- import Handlebars from "handlebars" ;
32import $ from "jquery" ;
43import TextField from "discourse/components/text-field" ;
54import { renderAvatar } from "discourse/helpers/user-avatar" ;
5+ import { default as computed , observes } from "discourse/lib/decorators" ;
66import userSearch from "discourse/lib/user-search" ;
7- import {
8- default as computed ,
9- observes ,
10- } from "discourse-common/utils/decorators" ;
11- import I18n from "I18n" ;
7+ import { escapeExpression } from "discourse/lib/utilities" ;
8+ import { i18n } from "discourse-i18n" ;
129
1310const template = function ( params ) {
1411 const options = params . options ;
@@ -17,11 +14,11 @@ const template = function (params) {
1714 if ( options . users ) {
1815 html += "<ul>" ;
1916 options . users . forEach ( ( u ) => {
20- html += `<li><a href title="${ u . name } ">` ;
17+ html += `<li><a href title="${ escapeExpression ( u . name ) } ">` ;
2118 html += renderAvatar ( u , { imageSize : "tiny" } ) ;
22- html += `<span class='username'>${ u . username } </span>` ;
19+ html += `<span class='username'>${ escapeExpression ( u . username ) } </span>` ;
2320 if ( u . name ) {
24- html += `<span class='name'>${ u . name } </span>` ;
21+ html += `<span class='name'>${ escapeExpression ( u . name ) } </span>` ;
2522 }
2623 html += `</a></li>` ;
2724 } ) ;
@@ -30,7 +27,7 @@ const template = function (params) {
3027
3128 html += "</div>" ;
3229
33- return new Handlebars . SafeString ( html ) . string ;
30+ return html ;
3431} ;
3532
3633export default TextField . extend ( {
@@ -42,7 +39,7 @@ export default TextField.extend({
4239
4340 @computed ( "placeholderKey" )
4441 placeholder ( placeholderKey ) {
45- return placeholderKey ? I18n . t ( placeholderKey ) : "" ;
42+ return placeholderKey ? i18n ( placeholderKey ) : "" ;
4643 } ,
4744
4845 @observes ( "usernames" )
0 commit comments