From 4a99c704a4dd2bb2b2a3bbe3d4b12f1768d089b0 Mon Sep 17 00:00:00 2001
From: Eugene <eugene@umputun.com>
Date: Wed, 20 Dec 2017 18:23:38 -0600
Subject: [PATCH] escape html in text and name

---
 README.md          | 2 +-
 app/rest/server.go | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 31345fd0..348f26d1 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# remark
+# remark [![Build Status](http://drone.umputun.com:9080/api/badges/umputun/remark/status.svg)](http://drone.umputun.com:9080/umputun/remark)
 
 description
 
diff --git a/app/rest/server.go b/app/rest/server.go
index e55572c8..1adcb432 100644
--- a/app/rest/server.go
+++ b/app/rest/server.go
@@ -1,6 +1,7 @@
 package rest
 
 import (
+	"html/template"
 	"log"
 	"net/http"
 	"strconv"
@@ -29,7 +30,7 @@ func (s *Server) Run() {
 
 	router.Post("/comment", s.createCommentCtrl)
 	router.Delete("/comment/{id}", s.deleteCommentCtrl)
-	router.Get("/find", s.getUrlComments)
+	router.Get("/find", s.getURLComments)
 	router.Get("/last/{max}", s.getLastComments)
 	router.Get("/id/{id}", s.getByID)
 	log.Fatal(http.ListenAndServe(":8080", router))
@@ -44,7 +45,10 @@ func (s *Server) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		httpError(w, r, http.StatusBadRequest, err, "can't bind comment")
 		return
 	}
+
 	comment.User.IP = strings.Split(r.RemoteAddr, ":")[0]
+	comment.User.Name = template.HTMLEscapeString(comment.User.Name)
+	comment.Text = template.HTMLEscapeString(comment.Text)
 
 	log.Printf("[INFO] create comment %+v", comment)
 
@@ -83,7 +87,7 @@ func (s *Server) deleteCommentCtrl(w http.ResponseWriter, r *http.Request) {
 }
 
 // GET /find?url=post-url
-func (s *Server) getUrlComments(w http.ResponseWriter, r *http.Request) {
+func (s *Server) getURLComments(w http.ResponseWriter, r *http.Request) {
 	url := r.URL.Query().Get("url")
 	log.Printf("[INFO] get comments for %s", url)