Merge pull request #1516 from sharelatex/as-sanitize-team-notice

Show sanitized HTML for team notice on subscription page

GitOrigin-RevId: 20256eed298a709d663bdfd0057e0d8462722a0c

services/web/app/coffee/Features/Subscription/SubscriptionViewModelBuilder.coffee

@@ -7,6 +7,7 @@ SubscriptionLocator = require("./SubscriptionLocator")
 V1SubscriptionManager = require("./V1SubscriptionManager")
 InstitutionsGetter = require("../Institutions/InstitutionsGetter")
 PublishersGetter = require("../Publishers/PublishersGetter")
+sanitizeHtml = require 'sanitize-html'
 logger = require('logger-sharelatex')
 _ = require("underscore")
 async = require('async')
@@ -94,6 +95,9 @@ module.exports =
 					trial_ends_at: recurlySubscription.trial_ends_at
 				}
 
+			for memberGroupSubscription in memberGroupSubscriptions
+				memberGroupSubscription.teamNotice = sanitizeHtml(memberGroupSubscription.teamNotice)
+
 			callback null, {
 				personalSubscription,
 				managedGroupSubscriptions,

services/web/app/views/subscriptions/dashboard/_group_memberships.pug

@@ -8,7 +8,8 @@ div(ng-controller="GroupMembershipController")
 					+teamName(groupSubscription)
 				- if (groupSubscription.teamNotice && groupSubscription.teamNotice != '')
 					p
-						em= groupSubscription.teamNotice
+						//- Team notice is sanitized in SubscriptionViewModelBuilder
+						em !{groupSubscription.teamNotice}
 				span 
 					button.btn.btn-danger.text-capitalise(ng-click="removeSelfFromGroup('"+groupSubscription.admin_id._id+"')") #{translate("leave_group")}
 			hr