closes #4877

src/socket.io/posts/edit.js

@@ -49,8 +49,8 @@ module.exports = function(SocketPosts) {
 					type: 'topic-rename',
 					uid: socket.uid,
 					ip: socket.ip,
-					oldTitle: result.topic.oldTitle,
-					newTitle: result.topic.title
+					oldTitle: validator.escape(String(result.topic.oldTitle)),
+					newTitle: validator.escape(String(result.topic.title))
 				});
 			}
 

src/socket.io/posts/tools.js

@@ -1,8 +1,11 @@
 'use strict';
 
 var async = require('async');
+var winston = require('winston');
+var validator = require('validator');
 
 var posts = require('../../posts');
+var topics = require('../../topics');
 var events = require('../../events');
 var websockets = require('../index');
 var socketTopics = require('../topics');
@@ -106,11 +109,17 @@ module.exports = function(SocketPosts) {
 
 				websockets.in('topic_' + data.tid).emit('event:post_purged', data.pid);
 
-				events.log({
-					type: 'post-purge',
-					uid: socket.uid,
-					pid: data.pid,
-					ip: socket.ip
+				topics.getTopicField(data.tid, 'title', function(err, title) {
+					if (err) {
+						return winston.error(err);
+					}
+					events.log({
+						type: 'post-purge',
+						uid: socket.uid,
+						pid: data.pid,
+						ip: socket.ip,
+						title: validator.escape(String(title))
+					});
 				});
 
 				callback();

src/socket.io/topics/tools.js

@@ -1,6 +1,9 @@
 'use strict';
 
 var async = require('async');
+var winston = require('winston');
+var validator = require('validator');
+
 var topics = require('../../topics');
 var events = require('../../events');
 var privileges = require('../../privileges');
@@ -94,11 +97,17 @@ module.exports = function(SocketTopics) {
 				socketHelpers.emitToTopicAndCategory(event, data);
 
 				if (action === 'delete' || action === 'restore' || action === 'purge') {
-					events.log({
-						type: 'topic-' + action,
-						uid: socket.uid,
-						ip: socket.ip,
-						tid: tid
+					topics.getTopicField(tid, 'title', function(err, title) {
+						if (err) {
+							return winston.error(err);
+						}
+						events.log({
+							type: 'topic-' + action,
+							uid: socket.uid,
+							ip: socket.ip,
+							tid: tid,
+							title: validator.escape(String(title))
+						});
 					});
 				}