5 files changed, 52 insertions, 13 deletions
diff --git a/client/components/main/editor.js b/client/components/main/editor.js
index da66bb74..da15407a 100755
--- a/client/components/main/editor.js
+++ b/client/components/main/editor.js
@@ -10,7 +10,7 @@ Template.editor.onRendered(() => {
       search(term, callback) {
         callback(Emoji.values.map((emoji) => {
           return emoji.includes(term) ? emoji : null;
-        }));
+        }).filter(Boolean));
       },
       template(value) {
         const imgSrc = Emoji.baseImagePath + value;
@@ -31,7 +31,7 @@ Template.editor.onRendered(() => {
         callback(currentBoard.activeMembers().map((member) => {
           const username = Users.findOne(member.userId).username;
           return username.includes(term) ? username : null;
-        }));
+        }).filter(Boolean));
       },
       template(value) {
         return value;
@@ -44,6 +44,8 @@ Template.editor.onRendered(() => {
   ]);
 });
 
+import sanitizeXss from 'xss';
+
 // XXX I believe we should compute a HTML rendered field on the server that
 // would handle markdown, emoji and user mentions. We can simply have two
 // fields, one source, and one compiled version (in HTML) and send only the
@@ -86,19 +88,14 @@ Blaze.Template.registerHelper('mentions', new Template('mentions', function() {
     content = content.replace(fullMention, Blaze.toHTML(link));
   }
 
-  return HTML.Raw(content);
+  return HTML.Raw(sanitizeXss(content));
 }));
 
 Template.viewer.events({
-  'click .js-open-member'(evt, tpl) {
-    const userId = evt.currentTarget.dataset.userid;
-    Popup.open('member').call({ userId }, evt, tpl);
-  },
-
   // Viewer sometimes have click-able wrapper around them (for instance to edit
   // the corresponding text). Clicking a link shouldn't fire these actions, stop
   // we stop these event at the viewer component level.
-  'click a'(evt) {
+  'click a'(evt, tpl) {
     evt.stopPropagation();
 
     // XXX We hijack the build-in browser action because we currently don't have
@@ -106,9 +103,16 @@ Template.viewer.events({
     // handled by a third party package that we can't configure easily. Fix that
     // by using directly `_blank` attribute in the rendered HTML.
     evt.preventDefault();
-    const href = evt.currentTarget.href;
-    if (href) {
-      window.open(href, '_blank');
+
+    const userId = evt.currentTarget.dataset.userid;
+    if (userId) {
+      Popup.open('member').call({ userId }, evt, tpl);
+    }
+    else {
+      const href = evt.currentTarget.href;
+      if (href) {
+        window.open(href, '_blank');
+      }
     }
   },
 });
diff --git a/client/components/main/header.jade b/client/components/main/header.jade
index 711e272c..bd0af880 100644
--- a/client/components/main/header.jade
+++ b/client/components/main/header.jade
@@ -45,3 +45,12 @@ template(name="header")
         else
           a.wekan-logo(href="{{pathFor 'home'}}" title="{{_ 'header-logo-title'}}")
             img(src="{{pathFor '/wekan-logo-header.png'}}" alt="Wekan")
+
+  if appIsOffline
+    +offlineWarning
+
+template(name="offlineWarning")
+  .offline-warning
+    p
+      i.fa.fa-warning
+      | {{_ 'app-is-offline'}}
diff --git a/client/components/main/header.js b/client/components/main/header.js
index 73024aa9..0337c72b 100644
--- a/client/components/main/header.js
+++ b/client/components/main/header.js
@@ -6,6 +6,10 @@ Template.header.helpers({
   hideLogo() {
     return Utils.isMiniScreen() && Session.get('currentBoard');
   },
+
+  appIsOffline() {
+    return !Meteor.status().connected;
+  },
 });
 
 Template.header.events({
diff --git a/client/components/main/header.styl b/client/components/main/header.styl
index 0b2ad860..0e35d38a 100644
--- a/client/components/main/header.styl
+++ b/client/components/main/header.styl
@@ -196,3 +196,15 @@
 
       li
         height: 28px
+
+.offline-warning
+  width: 100%
+  text-align: center
+  padding: 0
+  margin: 0
+  background: #F8ECBD
+  clear: both
+
+  p
+    margin: 7px
+    padding: 0
diff --git a/client/components/main/layouts.styl b/client/components/main/layouts.styl
index 83d4d693..1bc92b42 100644
--- a/client/components/main/layouts.styl
+++ b/client/components/main/layouts.styl
@@ -3,7 +3,7 @@
 global-reset()
 
 html, body, input, select, textarea, button
-  font: 14px Roboto, "Helvetica Neue", Arial, Helvetica, sans-serif
+  font: 14px Roboto, "Helvetica Neue", Arial, Helvetica, "Yu Gothic", "Meiryo", sans-serif
   line-height: 18px
   color: #4d4d4d
 
@@ -351,6 +351,11 @@ a
     background: darken(white, 13%)
     overflow-y: auto
 
+  a
+    text-decoration: underline
+    &:hover
+      color: #333
+
 .basicTabs-container .tabs-content-container
   padding: 0
   padding-top: 15px
@@ -374,3 +379,8 @@ a
   .wrapper
     height: 100%
     margin: 0px
+
+.inline-input
+  height: 37px
+  margin: 8px 10px 0 0
+  width: 50px