Apostrophe shows as HTML entity when adding user to organization

[jhult]

Gitea Version

1.15.3

Git Version

2.30.2

Operating System

alpine

How are you running Gitea?

Docker via gitea/gitea:latest-rootless

Database

SQLite

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Description

Create a user with an apostrophe in their name. Add them to an organization. Notice that the apostrophe is shown as the HTML entity (').

Cannot test on try.gitea.io since I need permissions (which I don't have) to add the user to an organization.

User is coming from an OpenID registry.

Screenshots

No response

[jhult]

Related issue: #2122

[zeripath]

Able to duplicate at least partially on try.gitea.io https://try.gitea.io/org/testOrf/teams/testorf-test-team:

[jhult]

Thanks @zeripath for confirming.

[zeripath]

@jhult are the two places I've demonstrated the only places where it happens? I.e. it's just in the drop-downs?

[jhult]

@zeripath, yes the issue appears to only occur in drop-downs.

[zeripath]

Hmm... the problem is:

gitea/modules/convert/user.go

Line 52 in 35b918f

FullName: markup.Sanitize(user.FullName),

This makes the strange assumption that'd we'd want users Full Names to be renderable...

[zeripath]

I'm not sure that we actually allow this.

[wxiaoguang]

Can this issue be closed? The PR is merged.

[zeripath]

I don't think we can backport the fixing PR as it's technically breaking. Therefore I'm removing this from 1.15.6 milestone and moving it to 1.16