Merge pull request #722 from Thulinma/noHtmlFixes

Fix two more HTML injection attacks.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/timeline/Reaction.h b/src/timeline/Reaction.h

index 47dac617..788e9ced 100644
--- a/src/timeline/Reaction.h
+++ b/src/timeline/Reaction.h
@@ -16,8 +16,8 @@ struct Reaction
         Q_PROPERTY(int count READ count)
 
 public:
-        QString key() const { return key_; }
-        QString users() const { return users_; }
+        QString key() const { return key_.toHtmlEscaped(); }
+        QString users() const { return users_.toHtmlEscaped(); }
         QString selfReactedEvent() const { return selfReactedEvent_; }
         int count() const { return count_; }