module Discuss
  module ApplicationHelper
    def message_person(mailbox_name, message)
      mailbox_name == 'inbox' ? message.sender : message.recipients.join(', ')
    end

    def markdown(text)
      html = Redcarpet::Render::HTML.new({})
      markdown = ::Redcarpet::Markdown.new(html)
      markdown.render(text).html_safe
    end
  end
end

module Discuss
  module ApplicationHelper
    def message_person(mailbox_name, message)
      mailbox_name == 'inbox' ? message.sender : message.recipients.join(', ')
    end

    def markdown(text)
      html = Redcarpet::Render::HTML.new(escape_html: true, safe_links_only: true)
      markdown = ::Redcarpet::Markdown.new(html)
      markdown.render(text).html_safe
    end
  end
end

Set redcarpet config to block XSS exploits
Set redcarpet config to block XSS exploits

 - should be redcarpet default