fix: escape bootswatchSkin and homepageRoute

src/user/settings.js

@@ -1,6 +1,8 @@
 
 'use strict';
 
+const validator = require('validator');
+
 const meta = require('../meta');
 const db = require('../database');
 const plugins = require('../plugins');
@@ -56,7 +58,8 @@ module.exports = function (User) {
 		settings.upvoteNotifFreq = getSetting(settings, 'upvoteNotifFreq', 'all');
 		settings.restrictChat = parseInt(getSetting(settings, 'restrictChat', 0), 10) === 1;
 		settings.topicSearchEnabled = parseInt(getSetting(settings, 'topicSearchEnabled', 0), 10) === 1;
-		settings.bootswatchSkin = settings.bootswatchSkin || '';
+		settings.bootswatchSkin = validator.escape(String(settings.bootswatchSkin || ''));
+		settings.homePageRoute = validator.escape(String(settings.homePageRoute || ''));
 		settings.scrollToMyPost = parseInt(getSetting(settings, 'scrollToMyPost', 1), 10) === 1;
 		settings.categoryWatchState = getSetting(settings, 'categoryWatchState', 'notwatching');