From 44431f8410ed6233fc82be5f76b1140d6330a22e Mon Sep 17 00:00:00 2001
From: Ben Lubar <ben.lubar@gmail.com>
Date: Sun, 20 Mar 2016 16:26:13 -0500
Subject: [PATCH] fix notifications that contain topic titles with commas in
 them

---
 src/notifications.js        |  7 +++++--
 src/socket.io/helpers.js    | 13 ++++++++++---
 src/socket.io/posts/flag.js |  8 ++++++--
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/src/notifications.js b/src/notifications.js
index af88fd7b5b..f32ca031d3 100644
--- a/src/notifications.js
+++ b/src/notifications.js
@@ -450,10 +450,13 @@ var async = require('async'),
 						});
 						var numUsers = usernames.length;
 
+						var title = S(notifications[modifyIndex].topicTitle).decodeHTMLEntities().s;
+						var titleEscaped = title.replace(/%/g, '&#37;').replace(/,/g, '&#44;');
+
 						if (numUsers === 2) {
-							notifications[modifyIndex].bodyShort = '[[' + mergeId + '_dual, ' + usernames.join(', ') + ', ' + notifications[modifyIndex].topicTitle + ']]';
+							notifications[modifyIndex].bodyShort = '[[' + mergeId + '_dual, ' + usernames.join(', ') + ', ' + titleEscaped + ']]';
 						} else if (numUsers > 2) {
-							notifications[modifyIndex].bodyShort = '[[' + mergeId + '_multiple, ' + usernames[0] + ', ' + (numUsers-1) + ', ' + notifications[modifyIndex].topicTitle + ']]';
+							notifications[modifyIndex].bodyShort = '[[' + mergeId + '_multiple, ' + usernames[0] + ', ' + (numUsers-1) + ', ' + titleEscaped + ']]';
 						}
 						break;
 
diff --git a/src/socket.io/helpers.js b/src/socket.io/helpers.js
index 3aeaaf0bf3..5524faf156 100644
--- a/src/socket.io/helpers.js
+++ b/src/socket.io/helpers.js
@@ -2,6 +2,7 @@
 
 var async = require('async');
 var winston = require('winston');
+var S = require('string');
 var nconf = require('nconf');
 
 var websockets = require('./index');
@@ -62,8 +63,11 @@ SocketHelpers.sendNotificationToPostOwner = function(pid, fromuid, notification)
 				return;
 			}
 
+			var title = S(results.topicTitle).decodeHTMLEntities().s;
+			var titleEscaped = title.replace(/%/g, '&#37;').replace(/,/g, '&#44;');
+
 			notifications.create({
-				bodyShort: '[[' + notification + ', ' + results.username + ', ' + results.topicTitle + ']]',
+				bodyShort: '[[' + notification + ', ' + results.username + ', ' + titleEscaped + ']]',
 				bodyLong: results.postObj.content,
 				pid: pid,
 				nid: 'post:' + pid + ':uid:' + fromuid,
@@ -93,8 +97,11 @@ SocketHelpers.sendNotificationToTopicOwner = function(tid, fromuid, notification
 			return;
 		}
 
+		var title = S(results.topicData.title).decodeHTMLEntities().s;
+		var titleEscaped = title.replace(/%/g, '&#37;').replace(/,/g, '&#44;');
+
 		notifications.create({
-			bodyShort: '[[' + notification + ', ' + results.username + ', ' + results.topicData.title + ']]',
+			bodyShort: '[[' + notification + ', ' + results.username + ', ' + titleEscaped + ']]',
 			path: nconf.get('relative_path') + '/topic/' + results.topicData.slug,
 			nid: 'tid:' + tid + ':uid:' + fromuid,
 			from: fromuid
@@ -111,4 +118,4 @@ SocketHelpers.emitToTopicAndCategory = function(event, data) {
 	websockets.in('category_' + data.cid).emit(event, data);
 };
 
-module.exports = SocketHelpers;
\ No newline at end of file
+module.exports = SocketHelpers;
diff --git a/src/socket.io/posts/flag.js b/src/socket.io/posts/flag.js
index eaefcea1e2..bbf7a4721c 100644
--- a/src/socket.io/posts/flag.js
+++ b/src/socket.io/posts/flag.js
@@ -1,6 +1,7 @@
 'use strict';
 
 var async = require('async');
+var S = require('string');
 
 var user = require('../../user');
 var groups = require('../../groups');
@@ -82,8 +83,11 @@ module.exports = function(SocketPosts) {
 				}, next);
 			},
 			function (results, next) {
+				var title = S(post.topic.title).decodeHTMLEntities().s;
+				var titleEscaped = title.replace(/%/g, '&#37;').replace(/,/g, '&#44;');
+
 				notifications.create({
-					bodyShort: '[[notifications:user_flagged_post_in, ' + flaggingUser.username + ', ' + post.topic.title + ']]',
+					bodyShort: '[[notifications:user_flagged_post_in, ' + flaggingUser.username + ', ' + titleEscaped + ']]',
 					bodyLong: post.content,
 					pid: data.pid,
 					nid: 'post_flag:' + data.pid + ':uid:' + socket.uid,
@@ -163,4 +167,4 @@ module.exports = function(SocketPosts) {
 			},
 		], callback);
 	};
-};
\ No newline at end of file
+};