closes #2284

src/topics/create.js

@@ -250,7 +250,6 @@ module.exports = function(Topics) {
 			},
 			function(results, next) {
 				postData.user = results.userInfo[0];
-				results.topicInfo.title = validator.escape(results.topicInfo.title);
 				postData.topic = results.topicInfo;
 				postData.content = results.content;
 
@@ -266,9 +265,10 @@ module.exports = function(Topics) {
 				postData.relativeTime = utils.toISOString(postData.timestamp);
 
 				if (parseInt(uid, 10)) {
-					Topics.notifyFollowers(postData.topic, postData, uid);
+					Topics.notifyFollowers(postData, uid);
 				}
 
+				postData.topic.title = validator.escape(postData.topic.title);
 				next(null, postData);
 			}
 		], callback);

src/topics/follow.js

@@ -3,6 +3,7 @@
 
 var async = require('async'),
 	nconf = require('nconf'),
+	S = require('string'),
 
 	db = require('../database'),
 	user = require('../user'),
@@ -21,8 +22,8 @@ module.exports = function(Topics) {
 		db.getSetMembers('tid:' + tid + ':followers', callback);
 	};
 
-	Topics.notifyFollowers = function(topicData, postData, exceptUid) {
-		Topics.getFollowers(topicData.tid, function(err, followers) {
+	Topics.notifyFollowers = function(postData, exceptUid) {
+		Topics.getFollowers(postData.topic.tid, function(err, followers) {
 			if (err || !Array.isArray(followers) || !followers.length) {
 				return;
 			}
@@ -36,12 +37,17 @@ module.exports = function(Topics) {
 				return;
 			}
 
+			var title = postData.topic.title;
+			if (title) {
+				title = S(title).decodeHTMLEntities().s;
+			}
+
 			notifications.create({
-				bodyShort: '[[notifications:user_posted_to, ' + postData.user.username + ', ' + topicData.title + ']]',
+				bodyShort: '[[notifications:user_posted_to, ' + postData.user.username + ', ' + title + ']]',
 				bodyLong: postData.content,
 				pid: postData.pid,
-				nid: 'tid:' + topicData.tid + ':pid:' + postData.pid + ':uid:' + exceptUid,
-				tid: topicData.tid,
+				nid: 'tid:' + postData.topic.tid + ':pid:' + postData.pid + ':uid:' + exceptUid,
+				tid: postData.topic.tid,
 				from: exceptUid
 			}, function(err, notification) {
 				if (!err && notification) {

src/user/notifications.js

@@ -4,6 +4,7 @@
 var async = require('async'),
 	nconf = require('nconf'),
 	winston = require('winston'),
+	S = require('string'),
 
 	user = require('../user'),
 	utils = require('../../public/src/utils'),
@@ -240,8 +241,13 @@ var async = require('async'),
 					return;
 				}
 
+				var title = topicData.title;
+				if (title) {
+					title = S(title).decodeHTMLEntities().s;
+				}
+
 				notifications.create({
-					bodyShort: '[[notifications:user_posted_topic, ' + postData.user.username + ', ' + topicData.title + ']]',
+					bodyShort: '[[notifications:user_posted_topic, ' + postData.user.username + ', ' + title + ']]',
 					bodyLong: postData.content,
 					pid: postData.pid,
 					nid: 'tid:' + postData.tid + ':pid:' + postData.pid + ':uid:' + uid,