XSS in username

diff --git a/models/user.go b/models/user.go
index e19fe73896a9e3b783cdf4fc9271fd3d8293d25b..4b2fd0ce66933af83afc4a4795951886a0e3b786 100644 (file)
--- a/models/user.go
+++ b/models/user.go
@@ -21,6 +21,7 @@ import (
        "time"
 
        "github.com/Unknwon/com"
+       "github.com/go-xorm/xorm"
        "github.com/nfnt/resize"
 
        "github.com/gogits/gogs/modules/avatar"
@@ -96,6 +97,15 @@ type User struct {
        Members     []*User `xorm:"-"`
 }
 
+func (u *User) AfterSet(colName string, _ xorm.Cell) {
+       switch colName {
+       case "full_name":
+               u.FullName = base.Sanitizer.Sanitize(u.FullName)
+       case "created":
+               u.Created = regulateTimeZone(u.Created)
+       }
+}
+
 // EmailAdresses is the list of all email addresses of a user. Can contain the
 // primary email address, but is not obligatory
 type EmailAddress struct {