From 6593c52acfdc256cb2034a7de1a9b2f7826efb0e Mon Sep 17 00:00:00 2001
From: GingerPlusPlus <woj.pawlik@gmail.com>
Date: Sun, 24 Sep 2017 14:55:26 +0200
Subject: [PATCH] Always use first_name in link, and escape it

I'm disappointed that you added that to TODO
instead of resolving it immiedetly, @poeti8.

Also added escapeHtml, so the bot doesn't break
when someone has something html-like in first_name.
---
 TODO.md     | 2 +-
 utils/tg.js | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/TODO.md b/TODO.md
index a5f5b27..80b22dc 100644
--- a/TODO.md
+++ b/TODO.md
@@ -27,7 +27,7 @@
 - [ ] All command be available with both `!` and `/`.
 - [x] Auto remove commands if they're not sent by admins.
 - [x] Auto remove joining messages.
-- [ ] Use first name instead of username for link.
+- [x] Use first name instead of username for link.
 - [ ] Commands work with username too.
 - [ ] Commands should tell which admin sent the command.
 - [ ] Ban and remove Arabic/Russian/Indian text.
diff --git a/utils/tg.js b/utils/tg.js
index 9b4e7b2..96cde4b 100644
--- a/utils/tg.js
+++ b/utils/tg.js
@@ -1,7 +1,10 @@
 'use strict';
 
-const link = ({ id, username, first_name }) =>
-	`<a href="tg://user?id=${id}">${username ? username : first_name}</a>`;
+const escapeHtml = s => s
+	.replace(/</g, '&lt;');
+
+const link = ({ id, first_name }) =>
+	`<a href="tg://user?id=${id}">${escapeHtml(first_name)}</a>`;
 
 const deleteAfter = ms => ctx =>
 	setTimeout(() =>