unescape quotes from user name #415

backend/app/store/comment.go

@@ -106,7 +106,7 @@ func (c *Comment) Sanitize() {
 	c.Text = p.Sanitize(c.Text)
 	c.Orig = p.Sanitize(c.Orig)
 	c.User.ID = template.HTMLEscapeString(c.User.ID)
-	c.User.Name = template.HTMLEscapeString(c.User.Name)
+	c.User.Name = c.escapeHtmlWithSome(c.User.Name)
 	c.User.Picture = p.Sanitize(c.User.Picture)
 }
 
@@ -130,3 +130,11 @@ func (c *Comment) Snippet(limit int) string {
 	}
 	return string(snippet) + " ..."
 }
+
+func (c *Comment) escapeHtmlWithSome(inp string) string {
+	res := template.HTMLEscapeString(inp)
+	res = strings.Replace(res, """, "\"", -1)
+	res = strings.Replace(res, "'", "'", -1)
+	res = strings.Replace(res, "&", "&", -1)
+	return res
+}

backend/app/store/comment_test.go

@@ -43,6 +43,10 @@ func TestComment_Sanitize(t *testing.T) {
 			inp: Comment{Text: "blah & & 123 — —"},
 			out: Comment{Text: `blah & & 123 — —`},
 		},
+		{
+			inp: Comment{Text: "blah & & 123", User: User{Name: "name <> & ' ` \""}},
+			out: Comment{Text: `blah &amp; &amp; 123`, User: User{Name: "name &lt;&gt; & ' ` \""}},
+		},
 	}
 
 	for n, tt := range tbl {