fix: escape thumbs, allow robots meta tag

public/src/ajaxify.js

@@ -223,7 +223,7 @@ ajaxify = window.ajaxify || {};
 	}
 
 	function updateTags() {
-		var metaWhitelist = ['title', 'description', /og:.+/, /article:.+/].map(function (val) {
+		var metaWhitelist = ['title', 'description', /og:.+/, /article:.+/, 'robots'].map(function (val) {
 			return new RegExp(val);
 		});
 		var linkWhitelist = ['canonical', 'alternate', 'up'];

src/topics/thumbs.js

@@ -64,7 +64,8 @@ async function getThumbs(set) {
 	if (cached !== undefined) {
 		return cached.slice();
 	}
-	const thumbs = await db.getSortedSetRange(set, 0, -1);
+	let thumbs = await db.getSortedSetRange(set, 0, -1);
+	thumbs = thumbs.map(t => validator.escape(String(t)));
 	cache.set(set, thumbs);
 	return thumbs.slice();
 }