escape title in post queue

6 years ago · 3e1b007f9f
parent f51b2e07f4
commit 3e1b007f9f
1 changed files with 2 additions and 0 deletions
--- a/src/controllers/admin/postqueue.js
+++ b/src/controllers/admin/postqueue.js
@ -1,6 +1,7 @@
 'use strict';

 var async = require('async');
+var validator = require('validator');

 var db = require('../../database');
 var user = require('../../user');
@ -81,6 +82,7 @@ function getQueuedPosts(ids, callback) {

 			async.map(postData, function (postData, next) {
 				postData.data.rawContent = postData.data.content;
+				postData.data.title = validator.escape(String(postData.data.title));
 				async.waterfall([
 					function (next) {
 						if (postData.data.cid) {