module Discuss
  module ApplicationHelper
    def message_person(mailbox_name, message)
      mailbox_name == 'inbox' ? message.sender : message.recipients.join(', ')
    end

    def markdown(text)
      html = Redcarpet::Render::HTML.new(escape_html: true, safe_links_only: true, no_images: true)
      markdown = ::Redcarpet::Markdown.new(html)
      markdown.render(text).html_safe
    end
  end
end

module Discuss
  module ApplicationHelper
    def message_person(mailbox_name, message)
      mailbox_name == 'inbox' ? message.sender : message.recipients.join(', ')
    end

    def markdown(text)
      markdown = ::Redcarpet::Markdown.new(html)
      html = Redcarpet::Render::Safe.new(no_images: true, no_styles: true, hard_wrap: true)
      markdown.render(text).html_safe
    end
  end
end

Switch to Safe, disable styles, turn on hard wrap
Switch to Safe, disable styles, turn on hard wrap

 - Safe implies escape_html and safe_links_only
 - Safe adds extra escaping of the block_code function
 - escape_html escapes styles, but if there's a way to add them with markdown no_styles will block that
 - hard_wrap allows us to insert <br>s with newlines in the copy (previously in textile this was hacked in with <span>s and CSS to make them divs (gross).