closes #1684

public/language/en_GB/notifications.json

@@ -17,6 +17,7 @@
 	"favourited_your_post": "<strong>%1</strong> has favourited your post.",
 	"user_flagged_post": "<strong>%1</strong> flagged a post.",
 	"user_posted_to" : "<strong>%1</strong> has posted a reply to: <strong>%2</strong>",
+	"user_mentioned_you_in": "<strong>%1</strong> mentioned you in <strong>%2</strong>",
 
 	"email-confirmed": "Email Confirmed",
 	"email-confirmed-message": "Thank you for validating your email. Your account is now fully activated.",

public/src/modules/chat.js

@@ -216,7 +216,8 @@ define('chat', ['taskbar', 'string', 'sounds'], function(taskbar, S, sounds) {
 
 
 				taskbar.push('chat', chatModal.attr('UUID'), {
-					title:'<i class="fa fa-comment"></i> ' + username,
+					title: username,
+					icon: 'fa-comment',
 					state: ''
 				});
 

public/src/modules/composer.js

@@ -59,8 +59,7 @@ define('composer', ['taskbar', 'composer/controls', 'composer/uploads', 'compose
 
 		translator.translate('[[topic:composer.new_topic]]', function(newTopicStr) {
 			taskbar.push('composer', uuid, {
-				title: post.title ? post.title : newTopicStr,
-				icon: post.picture
+				title: post.title ? post.title : newTopicStr
 			});
 		});
 

public/src/modules/notifications.js

@@ -24,7 +24,7 @@ define('notifications', ['sounds'], function(sound) {
 						} else {
 							image = '';
 						}
-						notification.text = $('<div/>').text(notification.text).html();
+
 						return '<li class="' + (notification.readClass || '') + '"><a href="' + (notification.path || '#') + '">' + image + '<span class="pull-right relTime">' + utils.relativeTime(notification.datetime, true) + '</span><span class="text">' + notification.text + '</span></a></li>';
 					}
 

public/src/modules/taskbar.js

@@ -58,13 +58,15 @@ define('taskbar', function() {
 
 		push: function(module, uuid, options) {
 			var element = taskbar.tasklist.find('li[data-uuid="'+uuid+'"]');
-			if(element.length)
+			if(element.length) {
 				return;
+			}
 			var title = $('<div></div>').text(options.title || 'NodeBB Task').html();
 
 			var	btnEl = $('<li />')
 				.html('<a href="#">' +
-					(options.icon ? '<img src="' + options.icon + '" />' : '') +
+					(options.icon ? '<i class="fa ' + options.icon + '"></i> ' : '') +
+					(options.image ? '<img src="' + options.image + '"/> ': '') +
 					'<span>' + title + '</span>' +
 					'</a>')
 				.attr({

src/notifications.js

@@ -4,6 +4,7 @@ var async = require('async'),
 	winston = require('winston'),
 	cron = require('cron').CronJob,
 	nconf = require('nconf'),
+	validator = require('validator'),
 
 	db = require('./database'),
 	utils = require('../public/src/utils'),
@@ -33,6 +34,7 @@ var async = require('async'),
 
 					db.getObjectFields('notifications:' + nid, ['nid', 'from', 'text', 'image', 'importance', 'score', 'path', 'datetime', 'uniqueId'], function(err, notification) {
 						notification.read = rank !== null ? true:false;
+						notification.text = validator.escape(notification.text);
 
 						if (notification.from && !notification.image) {
 							User.getUserField(notification.from, 'picture', function(err, picture) {