{% comment %} The conversation list's rows. Swapped into #inbox-list every three seconds when — and only when — something changed; see inbox/list.html for the 304 machinery. Every value in here arrived from a stranger (SECURITY-BASELINE §2): the contact's name, the message preview, the channel's display name. All of it renders under Django's default autoescaping and none of it is marked safe. {% endcomment %} {% load common_extras %} {% if not conversations %}
No conversations match these filters.
{% else %} {% for row in conversations %}