{"action":"created","issue":{"url":"https://api.github.com/repos/mar10/fancytree/issues/583","repository_url":"https://api.github.com/repos/mar10/fancytree","labels_url":"https://api.github.com/repos/mar10/fancytree/issues/583/labels{/name}","comments_url":"https://api.github.com/repos/mar10/fancytree/issues/583/comments","events_url":"https://api.github.com/repos/mar10/fancytree/issues/583/events","html_url":"https://github.com/mar10/fancytree/issues/583","id":146583878,"number":583,"title":"How to prevent using HTML in tree nodes?","user":{"login":"DumboJet","id":8492662,"avatar_url":"https://avatars.githubusercontent.com/u/8492662?v=3","gravatar_id":"","url":"https://api.github.com/users/DumboJet","html_url":"https://github.com/DumboJet","followers_url":"https://api.github.com/users/DumboJet/followers","following_url":"https://api.github.com/users/DumboJet/following{/other_user}","gists_url":"https://api.github.com/users/DumboJet/gists{/gist_id}","starred_url":"https://api.github.com/users/DumboJet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DumboJet/subscriptions","organizations_url":"https://api.github.com/users/DumboJet/orgs","repos_url":"https://api.github.com/users/DumboJet/repos","events_url":"https://api.github.com/users/DumboJet/events{/privacy}","received_events_url":"https://api.github.com/users/DumboJet/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-07T11:06:07Z","updated_at":"2016-04-07T11:18:12Z","closed_at":null,"body":"I am concerned with security a lot and I have noticed that the node title is rendered as HTML.\r\nCan I prevent that and render the title as text?\r\n\r\nCan someone suggest how to best achieve this (preferably without pre-encoding the titles on the server, but doing it on the client)?\r\n\r\nI use the tree like so:\r\n\r\n```\r\n        $(\"#tree\").fancytree({\r\n            checkbox: true,\r\n            source: @Html.Raw(@Model.TreeData),\r\n            lazyLoad: function(event, data) {\r\n                data.result =\r\n                $.ajax({\r\n                    url: '/Api/GetFancyTreeContent',\r\n                    type: 'post',\r\n                    data: {\r\n                        catId: data.node.key,\r\n                        skipCache: false\r\n                    }\r\n                });\r\n            },\r\n       ......................\r\n```\r\n\r\nAny input would be appreciated. :)\r\nThanks. :)"},"comment":{"url":"https://api.github.com/repos/mar10/fancytree/issues/comments/206822098","html_url":"https://github.com/mar10/fancytree/issues/583#issuecomment-206822098","issue_url":"https://api.github.com/repos/mar10/fancytree/issues/583","id":206822098,"user":{"login":"DumboJet","id":8492662,"avatar_url":"https://avatars.githubusercontent.com/u/8492662?v=3","gravatar_id":"","url":"https://api.github.com/users/DumboJet","html_url":"https://github.com/DumboJet","followers_url":"https://api.github.com/users/DumboJet/followers","following_url":"https://api.github.com/users/DumboJet/following{/other_user}","gists_url":"https://api.github.com/users/DumboJet/gists{/gist_id}","starred_url":"https://api.github.com/users/DumboJet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DumboJet/subscriptions","organizations_url":"https://api.github.com/users/DumboJet/orgs","repos_url":"https://api.github.com/users/DumboJet/repos","events_url":"https://api.github.com/users/DumboJet/events{/privacy}","received_events_url":"https://api.github.com/users/DumboJet/received_events","type":"User","site_admin":false},"created_at":"2016-04-07T11:18:12Z","updated_at":"2016-04-07T11:18:12Z","body":"OK. This addition seems to be working:\r\n\r\n```\r\n            ...\r\n            createNode: function(e, data) {\r\n                var n = data.node;\r\n                n.plainTitle = n.title; // Keep this for later use...\r\n                n.setTitle($('<div/>').text(n.title).html());\r\n            }\r\n            ...\r\n```\r\n\r\nState any objections you may have. :)"}}