Fix #5592 (#5593)

* Fix #5592
Escape translation tokens in topic titles, descriptions, profile about, and post contents

* Fix tests

src/categories/recentreplies.js

@@ -11,7 +11,7 @@ var posts = require('../posts');
 var topics = require('../topics');
 var privileges = require('../privileges');
 var batch = require('../batch');
-
+var translator = require('../translator');
 
 module.exports = function (Categories) {
 	Categories.getRecentReplies = function (cid, uid, count, callback) {
@@ -136,7 +136,7 @@ module.exports = function (Categories) {
 						teaser.user.uid = undefined;
 						teaser.topic = {
 							slug: topicData[index].slug,
-							title: validator.escape(String(topicData[index].title)),
+							title: translator.escape(validator.escape(String(topicData[index].title))),
 						};
 					}
 				});

src/controllers/accounts/profile.js

@@ -12,6 +12,7 @@ var accountHelpers = require('./helpers');
 var helpers = require('../helpers');
 var pagination = require('../../pagination');
 var messaging = require('../../messaging');
+var translator = require('../../translator');
 
 var profileController = {};
 
@@ -74,7 +75,7 @@ profileController.get = function (req, res, callback) {
 				return p && parseInt(p.deleted, 10) !== 1;
 			});
 			userData.hasPrivateChat = results.hasPrivateChat;
-			userData.aboutme = results.aboutme;
+			userData.aboutme = translator.escape(results.aboutme);
 			userData.nextStart = results.posts.nextStart;
 			userData.breadcrumbs = helpers.buildBreadcrumbs([{ text: userData.username }]);
 			userData.title = userData.username;

src/controllers/category.js

@@ -12,6 +12,7 @@ var meta = require('../meta');
 var pagination = require('../pagination');
 var helpers = require('./helpers');
 var utils = require('../utils');
+var translator = require('../translator');
 
 var categoryController = {};
 
@@ -160,6 +161,10 @@ categoryController.get = function (req, res, callback) {
 			return callback(err);
 		}
 
+		categoryData.topics.forEach(function (topic) {
+			topic.title = translator.escape(topic.title);
+		});
+		categoryData.description = translator.escape(categoryData.description);
 		categoryData.privileges = userPrivileges;
 		categoryData.showSelect = categoryData.privileges.editable;
 
@@ -207,7 +212,7 @@ categoryController.get = function (req, res, callback) {
 
 		categoryData['feeds:disableRSS'] = parseInt(meta.config['feeds:disableRSS'], 10) === 1;
 		categoryData.rssFeedUrl = nconf.get('relative_path') + '/category/' + categoryData.cid + '.rss';
-		categoryData.title = categoryData.name;
+		categoryData.title = translator.escape(categoryData.name);
 		pageCount = Math.max(1, Math.ceil(categoryData.topic_count / settings.topicsPerPage));
 		categoryData.pagination = pagination.create(currentPage, pageCount, req.query);
 		categoryData.pagination.rel.forEach(function (rel) {

src/controllers/topics.js

@@ -14,6 +14,7 @@ var plugins = require('../plugins');
 var helpers = require('./helpers');
 var pagination = require('../pagination');
 var utils = require('../utils');
+var translator = require('../translator');
 
 var topicsController = {};
 
@@ -129,13 +130,14 @@ topicsController.get = function (req, res, callback) {
 			plugins.fireHook('filter:controllers.topic.get', { topicData: topicData, uid: req.uid }, next);
 		},
 		function (data, next) {
+			data.topicData.title = translator.escape(data.topicData.title);
 			var breadcrumbs = [
 				{
 					text: data.topicData.category.name,
 					url: nconf.get('relative_path') + '/category/' + data.topicData.category.slug,
 				},
 				{
-					text: data.topicData.title,
+					text: translator.escape(data.topicData.title),
 				},
 			];
 

src/posts/parse.js

@@ -73,6 +73,7 @@ module.exports = function (Posts) {
 	};
 
 	function sanitizeSignature(signature) {
+		signature = translator.escape(signature);
 		var string = S(signature);
 		var tagsToStrip = [];
 

src/posts/summary.js

@@ -10,7 +10,7 @@ var user = require('../user');
 var plugins = require('../plugins');
 var categories = require('../categories');
 var utils = require('../utils');
-
+var translator = require('../translator');
 
 module.exports = function (Posts) {
 	Posts.getPostSummaryByPids = function (pids, uid, options, callback) {
@@ -119,7 +119,7 @@ module.exports = function (Posts) {
 
 			var cids = topics.map(function (topic) {
 				if (topic) {
-					topic.title = validator.escape(String(topic.title));
+					topic.title = translator.escape(validator.escape(String(topic.title)));
 					topic.deleted = parseInt(topic.deleted, 10) === 1;
 				}
 				return topic && topic.cid;