escape data on room enter

10 years ago · c8e0eab34e
parent 7dde229517
commit c8e0eab34e
1 changed files with 4 additions and 0 deletions
--- a/src/socket.io/meta.js
+++ b/src/socket.io/meta.js
@ -70,6 +70,10 @@ SocketMeta.rooms.enter = function(socket, data, callback) {
 		socket.currentRoom = data.enter;
 		if (data.enter.indexOf('topic') !== -1) {
 			data.uid = socket.uid;
+			data.picture = validator.escape(data.picture);
+			data.username = validator.escape(data.username);
+			data.userslug = validator.escape(data.userslug);
+
 			websockets.in(data.enter).emit('event:user_enter', data);
 		}
 	}