From a78b3a2d6d8d265001db4c96e48acec6fc72ba9c Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Sun, 6 May 2018 17:29:34 -0500
Subject: [PATCH] sanitize on preview

---
 app/rest/api/rest.go      | 2 ++
 app/store/comment.go      | 4 ++--
 app/store/comment_test.go | 2 +-
 app/store/service.go      | 4 ++--
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/rest/api/rest.go b/app/rest/api/rest.go
index 76417387..388d421a 100644
--- a/app/rest/api/rest.go
+++ b/app/rest/api/rest.go
@@ -164,6 +164,8 @@ func (s *Rest) previewCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't bind comment")
 		return
 	}
+
+	comment.Sanitize()
 	comment.Text = string(blackfriday.Run([]byte(comment.Text), blackfriday.WithExtensions(mdExt)))
 	render.HTML(w, r, comment.Text)
 }
diff --git a/app/store/comment.go b/app/store/comment.go
index 2a9b39e3..f179019e 100644
--- a/app/store/comment.go
+++ b/app/store/comment.go
@@ -84,8 +84,8 @@ func (c *Comment) SetDeleted() {
 	c.Deleted = true
 }
 
-// sanitize clean dangerous html/js from the comment
-func (c *Comment) sanitize() {
+// Sanitize clean dangerous html/js from the comment
+func (c *Comment) Sanitize() {
 	p := bluemonday.UGCPolicy()
 	c.Text = p.Sanitize(c.Text)
 	c.User.ID = template.HTMLEscapeString(c.User.ID)
diff --git a/app/store/comment_test.go b/app/store/comment_test.go
index 0c662a90..43e3b288 100644
--- a/app/store/comment_test.go
+++ b/app/store/comment_test.go
@@ -27,7 +27,7 @@ func TestComment_Sanitize(t *testing.T) {
 	}
 
 	for n, tt := range tbl {
-		tt.inp.sanitize()
+		tt.inp.Sanitize()
 		assert.Equal(t, tt.out, tt.inp, "check #%d", n)
 	}
 }
diff --git a/app/store/service.go b/app/store/service.go
index e69e1e45..c8fe2fd6 100644
--- a/app/store/service.go
+++ b/app/store/service.go
@@ -28,7 +28,7 @@ func (s *Service) Create(comment Comment) (commentID string, err error) {
 		comment.Votes = make(map[string]bool)
 	}
 
-	comment.sanitize()            // clear potentially dangerous js from all parts of comment
+	comment.Sanitize()            // clear potentially dangerous js from all parts of comment
 	comment.User.hashIP(s.Secret) // replace ip by hash
 
 	return s.Interface.Create(comment)
@@ -100,7 +100,7 @@ func (s *Service) EditComment(locator Locator, commentID string, text string, ed
 	comment.Text = text
 	comment.Edit = &edit
 	comment.Edit.Timestamp = time.Now()
-	comment.sanitize()
+	comment.Sanitize()
 	err = s.Put(locator, comment)
 	return comment, err
 }