diff --git a/app/rest/server.go b/app/rest/server.go index db02757c..db423641 100644 --- a/app/rest/server.go +++ b/app/rest/server.go @@ -234,14 +234,14 @@ func (s *Server) voteCtrl(w http.ResponseWriter, r *http.Request) { } id := chi.URLParam(r, "id") - log.Printf("[INFO] vote for comment %d", id) + log.Printf("[INFO] vote for comment %s", id) url := r.URL.Query().Get("url") vote := r.URL.Query().Get("vote") == "1" comment, err := s.Store.Vote(store.Locator{URL: url}, id, user.ID, vote) if err != nil { - log.Printf("[WARN] vote rejected for %s - %d, %s", user.ID, id, err) + log.Printf("[WARN] vote rejected for %s - %s, %s", user.ID, id, err) httpError(w, r, http.StatusBadRequest, err, "can't vote for comment") return } @@ -254,11 +254,11 @@ func httpError(w http.ResponseWriter, r *http.Request, code int, err error, deta render.JSON(w, r, JSON{"error": err.Error(), "details": details}) } -// renderJSONWithHTML -//allows html tags +// renderJSONWithHTML allows html tags func renderJSONWithHTML(w http.ResponseWriter, r *http.Request, v interface{}) { buf := &bytes.Buffer{} enc := json.NewEncoder(buf) + enc.SetEscapeHTML(false) if err := enc.Encode(v); err != nil { http.Error(w, err.Error(), http.StatusInternalServerError) return diff --git a/app/store/store.go b/app/store/store.go index cab064b4..51920c8f 100644 --- a/app/store/store.go +++ b/app/store/store.go @@ -7,6 +7,7 @@ import ( "crypto/sha1" "fmt" "log" + "strings" "time" "html/template" @@ -83,5 +84,7 @@ func sanitizeComment(comment Comment) Comment { comment.User.Name = template.HTMLEscapeString(comment.User.Name) comment.User.Picture = p.Sanitize(comment.User.Picture) comment.User.Profile = template.HTMLEscapeString(comment.User.Profile) + comment.Text = strings.Replace(comment.Text, "\n", "", -1) + comment.Text = strings.Replace(comment.Text, "\t", "", -1) return comment }