From e510c47f60035068d1223d9727f3a0d58e096e5e Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Sun, 7 Jan 2018 19:01:37 -0600
Subject: [PATCH] safer rest create cleanup

---
 app/rest/server.go | 12 ++++++++++--
 app/store/bolt.go  |  5 ++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/app/rest/server.go b/app/rest/server.go
index 3d4ef09b..5079c385 100644
--- a/app/rest/server.go
+++ b/app/rest/server.go
@@ -124,8 +124,16 @@ func (s *Server) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	comment.ID = ""                 // don't allow user to define ID, force auto-gen
-	comment.Timestamp = time.Time{} // reset time, force auto-gen
+	// reset comment to initial state
+	func() {
+		comment.ID = ""                 // don't allow user to define ID, force auto-gen
+		comment.Timestamp = time.Time{} // reset time, force auto-gen
+		comment.Votes = make(map[string]bool)
+		comment.Score = 0
+		comment.Edit = nil
+		comment.Pin = false
+	}()
+
 	comment.User = user
 	comment.User.IP = strings.Split(r.RemoteAddr, ":")[0]
 
diff --git a/app/store/bolt.go b/app/store/bolt.go
index 365ee037..3d21dccb 100644
--- a/app/store/bolt.go
+++ b/app/store/bolt.go
@@ -62,7 +62,10 @@ func (b *BoltDB) Create(comment Comment) (commentID string, err error) {
 	if comment.Timestamp.IsZero() {
 		comment.Timestamp = time.Now()
 	}
-	comment.Votes = make(map[string]bool)
+	if comment.Votes == nil {
+		comment.Votes = make(map[string]bool)
+	}
+
 	comment = sanitizeComment(comment) // clear potentially dangerous js from all parts of comment
 
 	bdb, err := b.db(comment.Locator.SiteID)