From 19bb2a0238b69d0ba4f314bab488d97d13d1dbe3 Mon Sep 17 00:00:00 2001
From: rejas <github@veeck.de>
Date: Sun, 28 Nov 2021 21:32:04 +0100
Subject: [PATCH 1/3] Add safe option to newsfeed templates

---
 modules/default/newsfeed/newsfeed.njk | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/default/newsfeed/newsfeed.njk b/modules/default/newsfeed/newsfeed.njk
index b957ffb9..531f0b47 100644
--- a/modules/default/newsfeed/newsfeed.njk
+++ b/modules/default/newsfeed/newsfeed.njk
@@ -33,7 +33,7 @@
             {% if (config.showSourceTitle and sourceTitle) or config.showPublishDate %}
                 <div class="newsfeed-source light small dimmed">
                     {% if sourceTitle and config.showSourceTitle %}
-                        {{ sourceTitle }}{% if config.showPublishDate %}, {% else %}: {% endif %}
+                        {{ sourceTitle | safe }}{% if config.showPublishDate %}, {% else %}: {% endif %}
                     {% endif %}
                     {% if config.showPublishDate %}
                         {{ publishDate }}:
@@ -46,9 +46,9 @@
             {% if config.showDescription %}
                 <div class="newsfeed-desc small light{{ ' no-wrap' if not config.wrapDescription }}">
                     {% if config.truncDescription %}
-                        {{ description | truncate(config.lengthDescription) }}
+                        {{ description | truncate(config.lengthDescription) | safe }}
                     {% else %}
-                        {{ description }}
+                        {{ description | safe }}
                     {% endif %}
                 </div>
             {% endif %}

From 1996efb183d5ff2d94fc17a1acf8f748866d292c Mon Sep 17 00:00:00 2001
From: rejas <github@veeck.de>
Date: Tue, 21 Dec 2021 13:31:39 +0100
Subject: [PATCH 2/3] Add new variable dangerouslyDisableAutoEscaping

---
 modules/default/newsfeed/newsfeed.js  |  3 ++-
 modules/default/newsfeed/newsfeed.njk | 22 +++++++++++++++-------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/modules/default/newsfeed/newsfeed.js b/modules/default/newsfeed/newsfeed.js
index 2fe340a2..0b781964 100644
--- a/modules/default/newsfeed/newsfeed.js
+++ b/modules/default/newsfeed/newsfeed.js
@@ -37,7 +37,8 @@ Module.register("newsfeed", {
 		endTags: [],
 		prohibitedWords: [],
 		scrollLength: 500,
-		logFeedWarnings: false
+		logFeedWarnings: false,
+		dangerouslyDisableAutoEscaping: false
 	},
 
 	// Define required scripts.
diff --git a/modules/default/newsfeed/newsfeed.njk b/modules/default/newsfeed/newsfeed.njk
index 531f0b47..04f0ec79 100644
--- a/modules/default/newsfeed/newsfeed.njk
+++ b/modules/default/newsfeed/newsfeed.njk
@@ -1,3 +1,11 @@
+{% macro escapeText(text, dangerouslyDisableAutoEscaping=false) %}
+  {% if dangerouslyDisableAutoEscaping %}
+    {{ text | safe}}
+  {% else %}
+    {{ text }}
+  {% endif %}
+{% endmacro %}
+
 {% if loaded %}
     {% if config.showAsList %}
         <ul class="newsfeed-list">
@@ -14,14 +22,14 @@
                         </div>
                     {% endif %}
                     <div class="newsfeed-title bright medium light{{ ' no-wrap' if not config.wrapTitle }}">
-                        {{ item.title }}
+                        {{ escapeText(item.title, config.dangerouslyDisableAutoEscaping) }}
                     </div>
                     {% if config.showDescription %}
                         <div class="newsfeed-desc small light{{ ' no-wrap' if not config.wrapDescription }}">
                             {% if config.truncDescription %}
-                                {{ item.description | truncate(config.lengthDescription) }}
+                                {{ escapeText(item.description | truncate(config.lengthDescription), config.dangerouslyDisableAutoEscaping) }}
                             {% else %}
-                                {{ item.description }}
+                                {{ escapeText(item.description, config.dangerouslyDisableAutoEscaping) }}
                             {% endif %}
                         </div>
                     {% endif %}
@@ -33,7 +41,7 @@
             {% if (config.showSourceTitle and sourceTitle) or config.showPublishDate %}
                 <div class="newsfeed-source light small dimmed">
                     {% if sourceTitle and config.showSourceTitle %}
-                        {{ sourceTitle | safe }}{% if config.showPublishDate %}, {% else %}: {% endif %}
+                        {{ escapeText(sourceTitle, config.dangerouslyDisableAutoEscaping) }}{% if config.showPublishDate %}, {% else %}: {% endif %}
                     {% endif %}
                     {% if config.showPublishDate %}
                         {{ publishDate }}:
@@ -41,14 +49,14 @@
                 </div>
             {% endif %}
             <div class="newsfeed-title bright medium light{{ ' no-wrap' if not config.wrapTitle }}">
-                {{ title }}
+                {{ escapeText(title, config.dangerouslyDisableAutoEscaping) }}
             </div>
             {% if config.showDescription %}
                 <div class="newsfeed-desc small light{{ ' no-wrap' if not config.wrapDescription }}">
                     {% if config.truncDescription %}
-                        {{ description | truncate(config.lengthDescription) | safe }}
+                        {{ escapeText(description | truncate(config.lengthDescription), config.dangerouslyDisableAutoEscaping) }}
                     {% else %}
-                        {{ description | safe }}
+                        {{ escapeText(description, config.dangerouslyDisableAutoEscaping) }}
                     {% endif %}
                 </div>
             {% endif %}

From 831afdf9e7327d2aa36ca0065645f0f932ed43b2 Mon Sep 17 00:00:00 2001
From: rejas <github@veeck.de>
Date: Tue, 21 Dec 2021 13:35:38 +0100
Subject: [PATCH 3/3] Update CHANGELOG

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1e89ba1..840e44b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ _This release is scheduled to be released on 2022-01-01._
 - Replace spectron with playwright, update dependencies including electron update to v16.
 - Added lithuanian language to translations.js
 - Show info message if newsfeed is empty (fixes #2731)
+- Added dangerouslyDisableAutoEscaping config option for newsfeed templates (fixes #2712)
 
 ### Fixed