Fix username html injection

server/src/db.h

@@ -9,13 +9,18 @@
 
 #include "post.h"
 
+void sanitize(std::string& str);
+
 struct User {
     uint64_t id = 0;
     std::string name = "";
     std::string passwordHash = "";
 
-    User(uint64_t id, const std::string& name, const std::string& passwordHash) :
-        id(id), name(name), passwordHash(passwordHash) {}
+    User(uint64_t id, std::string namein, const std::string& passwordHash) :
+        id(id), passwordHash(passwordHash) {
+            sanitize(namein);
+            name = namein;
+        }
 };
 
 class Database {

server/src/post.cpp

@@ -13,25 +13,25 @@ void replaceAll(std::string& str, const std::string& from, const std::string& to
     }
 }
 
+void sanitize(std::string& str) {
+    replaceAll(str, "&", "&");
+    replaceAll(str, "<", "&lt;");
+    replaceAll(str, ">", "&gt;");
+    replaceAll(str, "\"", "&quot;");
+    replaceAll(str, "'", "&apos;");
+}
+
 Post::Post(std::string contentin, const std::string& user) : user(user), time(std::time(nullptr)) {
-    replaceAll(contentin, "&", "&amp;");
-    replaceAll(contentin, "<", "&lt;");
-    replaceAll(contentin, ">", "&gt;");
-    replaceAll(contentin, "\"", "&quot;");
-    replaceAll(contentin, "'", "&apos;");
     // parse the post content markdown
+    sanitize(contentin);
     std::stringstream input(contentin);
     std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>();
     content = parser->Parse(input);
 }
  
 Post::Post(std::string contentin, uint64_t user) : userId(user), time(std::time(nullptr)) {
-    replaceAll(contentin, "&", "&amp;");
-    replaceAll(contentin, "<", "&lt;");
-    replaceAll(contentin, ">", "&gt;");
-    replaceAll(contentin, "\"", "&quot;");
-    replaceAll(contentin, "'", "&apos;");
     // parse the post content markdown
+    sanitize(contentin);
     std::stringstream input(contentin);
     std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>();
     content = parser->Parse(input);