This allows better Prettier integration: Prettier recognizes and
reformats tagged template literals with a tag named ‘html’.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
Also fix various variable names to consistently indicate which strings
contain HTML.
Some of these changes close cross-site scripting vulnerabilities, and
others are for consistency. It’s important to be meticulously
consistent about escaping so that changes that would introduce
vulnerabilities stand out as obviously wrong.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
The comment was created to document a piece of code in #902 but #909 addressed code quality
The comment is no longer essential and hence ought to be removed
This reverts commit 49b29bfed6 (#863).
The design of this feature is still under discussion; we expect it to
return after the security release.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
And enable the import/unambiguous ESLint rule as a check on our
partition between scripts and modules. After this commit, if you add
a new file and get this error:
✖ 1:1 This module could be parsed as a valid script. import/unambiguous
* For a module, add an `import` or `export` declaration to make the
file unambiguously a module (the empty `export {};` declaration
suffices).
* For a script, add the file to the xo overrides section of
package.json that marks it "sourceType": "script", and add a 'use
strict' declaration.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
The changes are mostly done via `xo --fix`; the other changes are
either trivial or disabling new linter rules that we plan to address
in future commits.
The changes here are mostly straightforward; the one exception is
removing a zulipdev.org hack.
We disable some lint rules we'll want to address later (E.g. we want
to switch to using async/await rather than .then()). But those are
out of scope for this commit.
This updates most of our direct dependencies to much newer versions
(Electron v6, with compatible versions of related packages like
Spectron).
Further, it updates all of our recursive dependencies with `npm update
--depth=999`.
Modified by tabbott to migrate to async/await for dialogs rather than
the old synchronous API.
Moves the social login to browser since there
was no way to verify the authencity of the
auth process for a custom server and to
prevent phishing attacks.
Fixes#849.
Co-authored-by: Kanishk Kakar <kanishk.kakar@gmail.com>
There were couple of issue solved by this commit:
- The button had extra 10px margin to right; this comes from .action class
- The "Delete" text and icon were not aligned
- The button looks bigger than other buttons
Both of which made the button look broken. We fix first by changing
.css-delete-action to #css-delete-action in css file; git grep shows
this is only used once and is used as id not a class. Then we use
display flex to fix the alinging of icon and text. We add box-sizing border-box
which solves the bigger width issue. We remove extra 10px margin that comes from
.action.
Fixes: #801.
Using `import * as` import syntax causes some problem if the
module exports a class or function. Because the whole point of
star import is to import every property the module exports. It turns
out we have been using it incorrectly in many places which this commit
fixes.
Then we fix a linting error by adding a eslint disable rule to solve
it along with a TODO because the way we currently do it is wrong.
Finally, to conclude this cleanup, we merge all the .gitignore paths
into once now that we can.
