safer rest create cleanup

app/rest/server.go

@@ -124,8 +124,16 @@ func (s *Server) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	comment.ID = ""                 // don't allow user to define ID, force auto-gen
-	comment.Timestamp = time.Time{} // reset time, force auto-gen
+	// reset comment to initial state
+	func() {
+		comment.ID = ""                 // don't allow user to define ID, force auto-gen
+		comment.Timestamp = time.Time{} // reset time, force auto-gen
+		comment.Votes = make(map[string]bool)
+		comment.Score = 0
+		comment.Edit = nil
+		comment.Pin = false
+	}()
+
 	comment.User = user
 	comment.User.IP = strings.Split(r.RemoteAddr, ":")[0]
 

app/store/bolt.go

@@ -62,7 +62,10 @@ func (b *BoltDB) Create(comment Comment) (commentID string, err error) {
 	if comment.Timestamp.IsZero() {
 		comment.Timestamp = time.Now()
 	}
-	comment.Votes = make(map[string]bool)
+	if comment.Votes == nil {
+		comment.Votes = make(map[string]bool)
+	}
+
 	comment = sanitizeComment(comment) // clear potentially dangerous js from all parts of comment
 
 	bdb, err := b.db(comment.Locator.SiteID)