nodebb-plugin-composer-default 10.2.27 → 10.2.29

package/library.js

@@ -236,16 +236,18 @@ function generateDiscardRoute(req, topicData) {
 }
 
 async function generateBody(req, postData) {
+	let body = ''
 	// Quoted reply
 	if (req.query.toPid && parseInt(req.query.quoted, 10) === 1 && postData) {
 		const username = await user.getUserField(postData.uid, 'username');
 		const translated = await translator.translate(`[[modules:composer.user-said, ${username}]]`);
-		return `${translated}\n` +
+		body = `${translated}\n` +
 			`> ${postData ? `${postData.content.replace(/\n/g, '\n> ')}\n\n` : ''}`;
 	} else if (req.query.body || req.query.content) {
-		return validator.escape(String(req.query.body || req.query.content));
+		body = validator.escape(String(req.query.body || req.query.content));
 	}
-	return postData ? postData.content : '';
+	body = postData ? postData.content : '';
+	return translator.escape(body);
 }
 
 async function getPostData(req) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-composer-default",
-  "version": "10.2.27",
+  "version": "10.2.29",
   "description": "Default composer for NodeBB",
   "main": "library.js",
   "repository": {

package/static/lib/composer.js

@@ -456,7 +456,7 @@ define('composer', [
 		var data = {
 			topicTitle: title,
 			titleLength: title.length,
-			body: utils.escapeHTML(postData.body),
+			body: translator.escape(utils.escapeHTML(postData.body)),
 			mobile: composer.bsEnvironment === 'xs' || composer.bsEnvironment === 'sm',
 			resizable: true,
 			thumb: postData.thumb,