From c83276a9d9c9bd91964c53aff3619ccf41d21a30 Mon Sep 17 00:00:00 2001
From: Raphael Sofaer <raphael@joindiaspora.com>
Date: Thu, 7 Jul 2011 22:17:42 -0700
Subject: [PATCH] OK, now I get what was going on.

---
 app/models/status_message.rb | 2 +-
 lib/diaspora/taggable.rb     | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/models/status_message.rb b/app/models/status_message.rb
index d037ec7d7..145b724ae 100644
--- a/app/models/status_message.rb
+++ b/app/models/status_message.rb
@@ -43,7 +43,7 @@ class StatusMessage < Post
 
     escaped_message = opts[:plain_text] ? self.raw_message: ERB::Util.h(self.raw_message)
     mentioned_message = self.format_mentions(escaped_message, opts)
-    Diaspora::Taggable.format_tags(mentioned_message, opts)
+    Diaspora::Taggable.format_tags(mentioned_message, opts.merge(:no_escape => true))
   end
 
   def format_mentions(text, opts = {})
diff --git a/lib/diaspora/taggable.rb b/lib/diaspora/taggable.rb
index 7c3ab66bd..8302cbe81 100644
--- a/lib/diaspora/taggable.rb
+++ b/lib/diaspora/taggable.rb
@@ -38,6 +38,7 @@ module Diaspora
 
     def self.format_tags(text, opts={})
       return text if opts[:plain_text]
+      text = ERB::Util.h(text) unless opts[:no_escape]
       regex = /(^|\s)#(#{VALID_TAG_BODY})/
       form_message = text.gsub(regex) do |matched_string|
         "#{$~[1]}<a href=\"/tags/#{$~[2]}\" class=\"tag\">##{$~[2]}</a>"