jteplitz602/Hopkins-Planner — comment on commit e037e7c95fff5fbf71e8cd36a829601ae918bf9f
File:  line 0
By jteplitz602:

Also Matt, the problem with html:true is that it allowed for the user to do script injection and run unauthorized code on the page. Which isn't a problem for students because their events don't get shared. But it is a problem for class events because if a teacher put some malicious code in an event description and we allowed it to be run for each student. They could collect passwords or session information. Which would be bad.