fix xss on guest handles, make sure guest handlers arent longer than max username length

src/topics/create.js

@@ -126,6 +126,11 @@ module.exports = function(Topics) {
 				if(!canCreate) {
 					return next(new Error('[[error:no-privileges]]'));
 				}
+
+				if (!guestHandleValid(data)) {
+					return next(new Error('[[error:guest-handle-invalid]]'));
+				}
+
 				user.isReadyToPost(uid, next);
 			},
 			function(next) {
@@ -209,6 +214,10 @@ module.exports = function(Topics) {
 					return next(new Error('[[error:no-privileges]]'));
 				}
 
+				if (!guestHandleValid(data)) {
+					return next(new Error('[[error:guest-handle-invalid]]'));
+				}
+
 				user.isReadyToPost(uid, next);
 			},
 			function(next) {
@@ -257,7 +266,7 @@ module.exports = function(Topics) {
 
 				// Username override for guests, if enabled
 				if (parseInt(meta.config.allowGuestHandles, 10) === 1 && parseInt(postData.uid, 10) === 0 && data.handle) {
-					postData.user.username = data.handle;
+					postData.user.username = validator.escape(data.handle);
 				}
 
 				if (results.settings.followTopicsOnReply) {
@@ -294,4 +303,12 @@ module.exports = function(Topics) {
 		callback();
 	}
 
+	function guestHandleValid(data) {
+		if (parseInt(meta.config.allowGuestHandles, 10) === 1 && parseInt(data.uid, 10) === 0 &&
+			data.handle && data.handle.length > meta.config.maximumUsernameLength) {
+			return false;
+		}
+		return true;
+	}
+
 };

src/topics/posts.js

@@ -5,6 +5,7 @@
 var async = require('async'),
 	winston = require('winston'),
 	_ = require('underscore'),
+	validator = require('validator'),
 
 	db = require('../database'),
 	user = require('../user'),
@@ -141,7 +142,7 @@ module.exports = function(Topics) {
 
 					// Username override for guests, if enabled
 					if (parseInt(meta.config.allowGuestHandles, 10) === 1 && parseInt(postObj.uid, 10) === 0 && postObj.handle) {
-						postObj.user.username = postObj.handle;
+						postObj.user.username = validator.escape(postObj.handle);
 					}
 				}
 			});