From ce1934e566873cd50446374e9109585daba5d42f Mon Sep 17 00:00:00 2001
From: barisusakli <barisusakli@gmail.com>
Date: Fri, 13 Jun 2014 13:57:38 -0400
Subject: [PATCH] closes #1684

---
 public/language/en_GB/notifications.json | 1 +
 public/src/modules/chat.js               | 3 ++-
 public/src/modules/composer.js           | 3 +--
 public/src/modules/notifications.js      | 2 +-
 public/src/modules/taskbar.js            | 6 ++++--
 src/notifications.js                     | 2 ++
 6 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/public/language/en_GB/notifications.json b/public/language/en_GB/notifications.json
index e630f0e801..10f56b6cfc 100644
--- a/public/language/en_GB/notifications.json
+++ b/public/language/en_GB/notifications.json
@@ -17,6 +17,7 @@
 	"favourited_your_post": "<strong>%1</strong> has favourited your post.",
 	"user_flagged_post": "<strong>%1</strong> flagged a post.",
 	"user_posted_to" : "<strong>%1</strong> has posted a reply to: <strong>%2</strong>",
+	"user_mentioned_you_in": "<strong>%1</strong> mentioned you in <strong>%2</strong>",
 
 	"email-confirmed": "Email Confirmed",
 	"email-confirmed-message": "Thank you for validating your email. Your account is now fully activated.",
diff --git a/public/src/modules/chat.js b/public/src/modules/chat.js
index a9ec7addcb..37d091d9ea 100644
--- a/public/src/modules/chat.js
+++ b/public/src/modules/chat.js
@@ -216,7 +216,8 @@ define('chat', ['taskbar', 'string', 'sounds'], function(taskbar, S, sounds) {
 
 
 				taskbar.push('chat', chatModal.attr('UUID'), {
-					title:'<i class="fa fa-comment"></i> ' + username,
+					title: username,
+					icon: 'fa-comment',
 					state: ''
 				});
 
diff --git a/public/src/modules/composer.js b/public/src/modules/composer.js
index 6c2c2a6eca..95e39dc246 100644
--- a/public/src/modules/composer.js
+++ b/public/src/modules/composer.js
@@ -59,8 +59,7 @@ define('composer', ['taskbar', 'composer/controls', 'composer/uploads', 'compose
 
 		translator.translate('[[topic:composer.new_topic]]', function(newTopicStr) {
 			taskbar.push('composer', uuid, {
-				title: post.title ? post.title : newTopicStr,
-				icon: post.picture
+				title: post.title ? post.title : newTopicStr
 			});
 		});
 
diff --git a/public/src/modules/notifications.js b/public/src/modules/notifications.js
index 5e4b5ef140..8553f55280 100644
--- a/public/src/modules/notifications.js
+++ b/public/src/modules/notifications.js
@@ -24,7 +24,7 @@ define('notifications', ['sounds'], function(sound) {
 						} else {
 							image = '';
 						}
-						notification.text = $('<div/>').text(notification.text).html();
+
 						return '<li class="' + (notification.readClass || '') + '"><a href="' + (notification.path || '#') + '">' + image + '<span class="pull-right relTime">' + utils.relativeTime(notification.datetime, true) + '</span><span class="text">' + notification.text + '</span></a></li>';
 					}
 
diff --git a/public/src/modules/taskbar.js b/public/src/modules/taskbar.js
index d56d9ffd9e..c670abe007 100644
--- a/public/src/modules/taskbar.js
+++ b/public/src/modules/taskbar.js
@@ -58,13 +58,15 @@ define('taskbar', function() {
 
 		push: function(module, uuid, options) {
 			var element = taskbar.tasklist.find('li[data-uuid="'+uuid+'"]');
-			if(element.length)
+			if(element.length) {
 				return;
+			}
 			var title = $('<div></div>').text(options.title || 'NodeBB Task').html();
 
 			var	btnEl = $('<li />')
 				.html('<a href="#">' +
-					(options.icon ? '<img src="' + options.icon + '" />' : '') +
+					(options.icon ? '<i class="fa ' + options.icon + '"></i> ' : '') +
+					(options.image ? '<img src="' + options.image + '"/> ': '') +
 					'<span>' + title + '</span>' +
 					'</a>')
 				.attr({
diff --git a/src/notifications.js b/src/notifications.js
index 8d9b6b361e..8f07dc2cf1 100644
--- a/src/notifications.js
+++ b/src/notifications.js
@@ -4,6 +4,7 @@ var async = require('async'),
 	winston = require('winston'),
 	cron = require('cron').CronJob,
 	nconf = require('nconf'),
+	validator = require('validator'),
 
 	db = require('./database'),
 	utils = require('../public/src/utils'),
@@ -33,6 +34,7 @@ var async = require('async'),
 
 					db.getObjectFields('notifications:' + nid, ['nid', 'from', 'text', 'image', 'importance', 'score', 'path', 'datetime', 'uniqueId'], function(err, notification) {
 						notification.read = rank !== null ? true:false;
+						notification.text = validator.escape(notification.text);
 
 						if (notification.from && !notification.image) {
 							User.getUserField(notification.from, 'picture', function(err, picture) {