closed #2571

src/controllers/api.js

@@ -6,6 +6,7 @@ var pkg = require('./../../package.json'),
 	plugins = require('./../plugins'),
 	widgets = require('../widgets'),
 
+	validator = require('validator'),
 	nconf = require('nconf');
 
 var apiController = {};
@@ -16,7 +17,7 @@ apiController.getConfig = function(req, res, next) {
 	config.socketioTransports = nconf.get('socket.io:transports') || ['polling', 'websocket'];
 	config.websocketAddress = nconf.get('socket.io:address') || '';
 	config.version = pkg.version;
-	config.siteTitle = meta.config.title || meta.config.browserTitle || 'NodeBB';
+	config.siteTitle = validator.escape(meta.config.title || meta.config.browserTitle || 'NodeBB');
 	config.showSiteTitle = parseInt(meta.config.showSiteTitle, 10) === 1;
 	config.postDelay = meta.config.postDelay;
 	config.minimumTitleLength = meta.config.minimumTitleLength;

src/controllers/index.js

@@ -43,13 +43,13 @@ Controllers.home = function(req, res, next) {
 		header: function (next) {
 			res.locals.metaTags = [{
 				name: "title",
-				content: meta.config.title || 'NodeBB'
+				content: validator.escape(meta.config.title || 'NodeBB')
 			}, {
 				name: "description",
-				content: meta.config.description || ''
+				content: validator.escape(meta.config.description || '')
 			}, {
 				property: 'og:title',
-				content: 'Index | ' + (meta.config.title || 'NodeBB')
+				content: 'Index | ' + validator.escape(meta.config.title || 'NodeBB')
 			}, {
 				property: 'og:type',
 				content: 'website'

src/meta/title.js

@@ -17,7 +17,7 @@ module.exports = function(Meta) {
 
 	Meta.title.build = function (urlFragment, language, locals, callback) {
 		var uri = '';
-		var fallbackTitle = Meta.config.browserTitle || Meta.config.title || 'NodeBB';
+		var fallbackTitle = validator.escape(Meta.config.browserTitle || Meta.config.title || 'NodeBB');
 		try {
 			uri = decodeURIComponent(urlFragment);
 		} catch(e) {