Fixes #49 (partially)

This version contains minified, concatenated or otherwise machine-generated code. Please provide the original sources, together with instructions on how to generate the final XPI. Source code must be provided as an archive and uploaded using the source code upload field, which can be done during submission or on the version page in the developer hub. Please read through the instructions at https://developer.mozilla.org/en-US/Add-ons/Source_Code_Submission. Here are some examples that were discovered: resources\habitica-markdown.min.js

I've used this tool to unminify habitica-markdown.min.js I had to update manifest.json and chat.json with the new habitica-markdown.js file

Please remove all unused permissions from your manifest. Here are some examples that were discovered: https://ajax.googleapis.com/

I've removed this permission from manifest.json

This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Safely_inserting_external_content_into_a_page . Here are some examples that were discovered: mainChat\chat_inPage.js line 147, 194, 199 and possible more.

This was more troublesome. I believe it has 2 solutions: convert HTML strings to proper html elements being created with Javascript or using a DOMPurifier as recommend by Firefox This lib is imported at chat.js and applied in several parts of chat_inPage.js

All changes were ported to Chrome's version and tested.

The privacy policy is still needed and have to be handled by Habitica Staff.

PS: some formatting have been changed, sorry about that

Fixes #11404

Changes

Renamed like active class name to activeLike, so it is not get confused with current active route class.

The bug in the issue was occurring because Vue Router applies a class name to links that are active routes. This class name is not applied when the route is activated by a link - which are 90% of the cases -, but it is when accessed from a new tab or url. Also, by default, this active route class name is router-link-active, but in the Habitica's project it is replaced via the linkActiveClass router constructor option in router/index.js.

The active class name was being applied to the like button when the user has liked someone's post and also when displaying a user's chat message while visiting its profile directly (new tab/direct url).

The fix is changing this active like class name to activeLike, so it doens't get "triggered" by active route class name.

UUID: 40387571-91ee-489e-960f-278bf8fd503a