| … | … | @@ -1754,7 +1754,10 @@ export function discover (handles, following = [], profiles = {}, ns = null) { |
| 1754 | 1754 | ? '<span class="who">following</span>' |
| 1755 | 1755 | : '<form method="post" action="/follow" class="inline">' + |
| 1756 | 1756 | '<input type="hidden" name="feed" value="' + esc(h.feed) + '"><button>follow</button></form>' |
| 1757 | | return '<li>' + name + '@' + esc(h.handle) + flag + |
| 1757 | // ⛔ LINKED, like search's rows already are (`nameRows` above). Without this the page could show |
| 1758 | // you who exists and offer to follow them, but not let you LOOK at them first — which is the |
| 1759 | // one thing anyone wants before following a stranger. |
| 1760 | return '<li>' + name + '<a href="/u/' + esc(h.feed) + '">@' + esc(h.handle) + '</a>' + flag + |
| 1758 | 1761 | // ⛔ The key is always shown. A handle is a claim; the key is the unforgeable thing, and this |
| 1759 | 1762 | // page's whole job is handing someone a feed to follow. |
| 1760 | 1763 | ' <code class="who">' + esc(String(h.feed).slice(0, 8)) + '</code> ' + action + '</li>' |