properly closes #6698

src/flags.js

@@ -99,10 +99,7 @@ Flags.get = function (flagId, callback) {
 					target_readable: data.base.type.charAt(0).toUpperCase() + data.base.type.slice(1) + ' ' + data.base.targetId,
 					target: payload.targetObj,
 					history: data.history,
-					notes: data.notes.map((note) => {
+					notes: data.notes,
-						note.content = validator.escape(note.content);
-						return note;
-					}),
 					reporter: payload.userObj,
 				}));
 			});
@@ -323,6 +320,7 @@ Flags.getNotes = function (flagId, callback) {
 
 				next(null, notes.map(function (note, idx) {
 					note.user = users[idx];
+					note.content = validator.escape(note.content);
 					return note;
 				}));
 			});