Merge pull request #722 from Thulinma/noHtmlFixes

Fix two more HTML injection attacks.

2 files changed, 3 insertions, 3 deletions

diff --git a/src/RoomsModel.cpp b/src/RoomsModel.cpp

index 80f13756..656a0deb 100644
--- a/src/RoomsModel.cpp
+++ b/src/RoomsModel.cpp
@@ -77,7 +77,7 @@ RoomsModel::data(const QModelIndex &index, int role) const
                         return QString::fromStdString(
                           roomInfos.at(roomids[index.row()]).avatar_url);
                 case Roles::RoomID:
-                        return roomids[index.row()];
+                        return roomids[index.row()].toHtmlEscaped();
                 }
         }
         return {};
diff --git a/src/timeline/Reaction.h b/src/timeline/Reaction.h

index 47dac617..788e9ced 100644
--- a/src/timeline/Reaction.h
+++ b/src/timeline/Reaction.h
@@ -16,8 +16,8 @@ struct Reaction
         Q_PROPERTY(int count READ count)
 
 public:
-        QString key() const { return key_; }
-        QString users() const { return users_; }
+        QString key() const { return key_.toHtmlEscaped(); }
+        QString users() const { return users_.toHtmlEscaped(); }
         QString selfReactedEvent() const { return selfReactedEvent_; }
         int count() const { return count_; }