From 8c3ecf2e94b6a067e6e658d2619844e647715c25 Mon Sep 17 00:00:00 2001
From: Bob Mottram <bob@freedombone.net>
Date: Sat, 12 Dec 2020 15:36:44 +0000
Subject: [PATCH] Even if other instances include arbitrary html within profile
 tags it isn't rendered within person options

---
 webapp_person_options.py | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/webapp_person_options.py b/webapp_person_options.py
index 89e142d03..aa60ed3e1 100644
--- a/webapp_person_options.py
+++ b/webapp_person_options.py
@@ -11,6 +11,7 @@ from shutil import copyfile
 from petnames import getPetName
 from person import isPersonSnoozed
 from posts import isModerator
+from utils import removeHtml
 from utils import getDomainFromActor
 from utils import getNicknameFromActor
 from blocking import isBlocked
@@ -113,35 +114,36 @@ def htmlPersonOptions(defaultTimeline: str,
         optionsStr += \
             '<p class="imText">' + translate['Email'] + \
             ': <a href="mailto:' + \
-            emailAddress + '">' + emailAddress + '</a></p>\n'
+            emailAddress + '">' + removeHtml(emailAddress) + '</a></p>\n'
     if xmppAddress:
         optionsStr += \
             '<p class="imText">' + translate['XMPP'] + \
-            ': <a href="xmpp:' + xmppAddress + '">' + \
+            ': <a href="xmpp:' + removeHtml(xmppAddress) + '">' + \
             xmppAddress + '</a></p>\n'
     if matrixAddress:
         optionsStr += \
             '<p class="imText">' + translate['Matrix'] + ': ' + \
-            matrixAddress + '</p>\n'
+            removeHtml(matrixAddress) + '</p>\n'
     if ssbAddress:
         optionsStr += \
-            '<p class="imText">SSB: ' + ssbAddress + '</p>\n'
+            '<p class="imText">SSB: ' + removeHtml(ssbAddress) + '</p>\n'
     if blogAddress:
         optionsStr += \
-            '<p class="imText">Blog: <a href="' + blogAddress + '">' + \
-            blogAddress + '</a></p>\n'
+            '<p class="imText">Blog: <a href="' + \
+            removeHtml(blogAddress) + '">' + \
+            removeHtml(blogAddress) + '</a></p>\n'
     if toxAddress:
         optionsStr += \
-            '<p class="imText">Tox: ' + toxAddress + '</p>\n'
+            '<p class="imText">Tox: ' + removeHtml(toxAddress) + '</p>\n'
     if jamiAddress:
         optionsStr += \
-            '<p class="imText">Jami: ' + jamiAddress + '</p>\n'
+            '<p class="imText">Jami: ' + removeHtml(jamiAddress) + '</p>\n'
     if PGPfingerprint:
         optionsStr += '<p class="pgp">PGP: ' + \
-            PGPfingerprint.replace('\n', '<br>') + '</p>\n'
+            removeHtml(PGPfingerprint).replace('\n', '<br>') + '</p>\n'
     if PGPpubKey:
         optionsStr += '<p class="pgp">' + \
-            PGPpubKey.replace('\n', '<br>') + '</p>\n'
+            removeHtml(PGPpubKey).replace('\n', '<br>') + '</p>\n'
     optionsStr += '  <form method="POST" action="' + \
         originPathStr + '/personoptions">\n'
     optionsStr += '    <input type="hidden" name="pageNumber" value="' + \