Merge pull request #6517 from artoscinote/ma_SCI_9574

Fix user smart annotations [SCI-9574]

app/helpers/application_helper.rb

@@ -137,14 +137,13 @@ module ApplicationHelper
   # and outputs a popover with user information
   def smart_annotation_filter_users(text, team, base64_encoded_imgs: false)
     sa_user = /\[\@(.*?)~([0-9a-zA-Z]+)\]/
-    new_text = text.gsub(sa_user) do |el|
+    text.gsub(sa_user) do |el|
       match = el.match(sa_user)
       user = User.find_by_id(match[2].base62_decode)
       next unless user
 
       popover_for_user_name(user, team, false, false, base64_encoded_imgs)
     end
-    sanitize_input(new_text)
   end
 
   # Generate smart annotation link for one user object

app/views/shared/_atwho_user_container.html.erb

@@ -18,8 +18,8 @@
     data-placement="top"
     data-toggle="popover"
     data-content=""
-    data-full-name="<%= user.full_name %>"
-    data-email="<%= user.email %>"
+    data-full-name="<%= escape_input(user.full_name) %>"
+    data-email="<%= escape_input(user.email) %>"
     data-popover-html="<%= popover_html %>"
     data-user-avatar-popover-absolute-url="<%= user_avatar_absolute_url(
       user,
@@ -27,9 +27,9 @@
       base64_encoded_imgs
     ) %>"
   >
-    <%= user.full_name %>
+    <%= escape_input(user.full_name) %>
   </a>
   <% unless skip_user_status || user_still_in_team %>
     <%= I18n.t('atwho.res.removed') %>
   <% end %>
-</span>
+</span>