Fix text color in dashboard inputs, sanitize remote status content in UI,

simplify FanOutOnWriteService, add /api/accounts/lookup method

app/assets/javascripts/api/accounts/lookup.coffee

@@ -0,0 +1,3 @@
+# Place all the behaviors and hooks related to the matching controller here.
+# All this logic will automatically be available in application.js.
+# You can use CoffeeScript in this file: http://coffeescript.org/

app/assets/stylesheets/dashboard.scss

@@ -243,6 +243,7 @@
       padding-bottom: 6px;
       font-size: 14px;
       font-family: 'Roboto', sans-serif;
+      color: #282c37;
 
       &:focus, &:active {
         border-bottom: 2px solid #2b90d9;

app/controllers/api/accounts/lookup_controller.rb

@@ -0,0 +1,11 @@
+class Api::Accounts::LookupController < ApplicationController
+  def index
+    @accounts = Account.where(domain: nil).where(username: lookup_params)
+  end
+
+  private
+
+  def lookup_params
+    (params[:usernames] || '').split(',').map(&:strip)
+  end
+end

app/helpers/api/accounts/lookup_helper.rb

@@ -0,0 +1,2 @@
+module Api::Accounts::LookupHelper
+end

app/helpers/stream_entries_helper.rb

@@ -27,4 +27,12 @@ module StreamEntriesHelper
   def favourited_by_me_class(status)
     user_signed_in? && current_user.account.favourited?(status) ? 'favourited' : ''
   end
+
+  def content_for_status(actual_status)
+    if actual_status.local?
+      linkify(actual_status)
+    else
+      sanitize(actual_status.content, tags: %w(a br p), attributes: %w(href rel))
+    end
+  end
 end

app/services/base_service.rb

@@ -1,6 +1,8 @@
 class BaseService
-  include RoutingHelper
   include ActionView::Helpers::TextHelper
+  include ActionView::Helpers::SanitizeHelper
+
+  include RoutingHelper
   include ApplicationHelper
   include AtomBuilderHelper
 end

app/services/fan_out_on_write_service.rb

@@ -4,18 +4,25 @@ class FanOutOnWriteService < BaseService
   # Push a status into home and mentions feeds
   # @param [Status] status
   def call(status)
-    replied_to_user = status.reply? ? status.thread.account : nil
+    deliver_to_self(status) if status.account.local?
+    deliver_to_followers(status, status.reply? ? status.thread.account : nil)
+    deliver_to_mentioned(status)
+  end
 
-    # Deliver to local self
-    push(:home, status.account.id, status) if status.account.local?
+  private
 
-    # Deliver to local followers
+  def deliver_to_self(status)
+    push(:home, status.account.id, status)
+  end
+
+  def deliver_to_followers(status, replied_to_user)
     status.account.followers.each do |follower|
       next if (status.reply? && !(follower.id = replied_to_user.id || follower.following?(replied_to_user))) || !follower.local?
       push(:home, follower.id, status)
     end
+  end
 
-    # Deliver to local mentioned
+  def deliver_to_mentioned(status)
     status.mentioned_accounts.each do |mention|
       mentioned_account = mention.account
       next unless mentioned_account.local?
@@ -23,8 +30,6 @@ class FanOutOnWriteService < BaseService
     end
   end
 
-  private
-
   def push(type, receiver_id, status)
     redis.zadd(key(type, receiver_id), status.created_at.to_i, status.id)
     trim(type, receiver_id)

app/services/send_interaction_service.rb

@@ -1,6 +1,4 @@
 class SendInteractionService < BaseService
-  include AtomBuilderHelper
-
   # Send an Atom representation of an interaction to a remote Salmon endpoint
   # @param [StreamEntry] stream_entry
   # @param [Account] target_account

app/views/accounts/_grid_card.html.haml

@@ -5,4 +5,4 @@
       = link_to url_for_target(account) do
         %span.display_name= display_name(account)
         %span.username= "@#{account.acct}"
-  %p.note= truncate(account.note, length: 150)
+  %p.note= truncate(strip_tags(account.note), length: 150)

app/views/api/accounts/lookup/index.rabl

@@ -0,0 +1,2 @@
+collection @accounts
+extends('api/accounts/show')

app/views/stream_entries/_status.html.haml

@@ -33,8 +33,7 @@
           .counter-btn{ class: favourited_by_me_class(status) }
             %i.fa.fa-star
             %span.counter-number= status.reblog? ? status.reblog.favourites_count : status.favourites_count
-      .content
-        = status.reblog? ? (status.reblog.local? ? linkify(status.reblog) : status.reblog.content.html_safe) : (status.local? ? linkify(status) : status.content.html_safe)
+      .content= content_for_status(status.reblog? ? status.reblog : status)
 
 - if include_threads
   - status.descendants.with_includes.with_counters.each do |status|