xmpp.chapril.org-conversejs/src/templates/message.html

<div class="chat-message {{{extra_classes}}}" data-isodate="{{{isodate}}}" data-msgid="{{{msgid}}}">
    <span class="chat-msg-author chat-msg-{{{sender}}}">{{{time}}} {{{username}}}:&nbsp;</span>
    <span class="chat-msg-content"><!-- message gets added here via renderMessage --></span>
</div>
Escape user-generated input to avoid injection attacks 2017-02-13 09:23:42 +01:00			`<div class="chat-message {{{extra_classes}}}" data-isodate="{{{isodate}}}" data-msgid="{{{msgid}}}">`
			`<span class="chat-msg-author chat-msg-{{{sender}}}">{{{time}}} {{{username}}}: </span>`
Remove `{{message}}` interpolation. It's not used and confuses people. Instead the message gets inserted via `$.text`, to avoid injection attacks. 2016-11-02 12:09:15 +01:00			`<span class="chat-msg-content"><!-- message gets added here via renderMessage --></span>`
Initial support for external HTMl templates. Updates #77 2013-12-30 20:27:57 +01:00			`</div>`