switch to use link_to_member to prevent 500 if user is a project owner but does not have membership and leave comment

1 files changed, 10 insertions, 5 deletions

diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index f7325791579..158925ba6c0 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -20,16 +20,21 @@ module ProjectsHelper
     end
   end
 
-  def link_to_member(project, author)
+  def link_to_member(project, author, opts = {})
+    default_opts = { avatar: true }
+    opts = default_opts.merge(opts)
+
     return "(deleted)" unless author
 
+    author_html =  ""
+
     # Build avatar image tag
-    avatar = image_tag(gravatar_icon(author.try(:email)), width: 16, class: "lil_av")
+    author_html << image_tag(gravatar_icon(author.try(:email)), width: 16, class: "lil_av") if opts[:avatar]
 
     # Build name span tag
-    name = content_tag :span, author.name, class: 'author'
+    author_html << content_tag(:span, sanitize(author.name), class: 'author')
 
-    author_html = avatar + name
+    author_html = author_html.html_safe
 
     tm = project.team_member_by_id(author)
 
@@ -37,7 +42,7 @@ module ProjectsHelper
       link_to author_html, project_team_member_path(project, tm), class: "author_link"
     else
       author_html
-    end
+    end.html_safe
   end
 
   def tm_path team_member