throw in the description with some sanitizatoin

model/torrent.go

@@ -30,7 +30,7 @@ type Torrents struct {
 	Date            int64          `gorm:"column:date"`
 	Downloads       int            `gorm:"column:downloads"`
 	Filesize        int64          `gorm:"column:filesize"`
-	Description     []byte         `gorm:"column:description"`
+	Description     string         `gorm:"column:description"`
 	Comments        []byte         `gorm:"column:comments"`
 }
 

router/upload.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"github.com/ewhal/nyaa/util"
 	"github.com/ewhal/nyaa/util/metainfo"
+	"github.com/microcosm-cc/bluemonday"
 	"github.com/zeebo/bencode"
 	"net/http"
 	"net/url"
@@ -52,6 +53,8 @@ var ErrInvalidTorrentDescription = errors.New("torrent description is invalid")
 // error indicating a torrent's category is invalid
 var ErrInvalidTorrentCategory = errors.New("torrent category is invalid")
 
+var p = bluemonday.UGCPolicy()
+
 /**
 UploadForm.ExtractInfo takes an http request and computes all fields for this form
 */
@@ -64,7 +67,7 @@ func (f *UploadForm) ExtractInfo(r *http.Request) error {
 
 	// trim whitespaces
 	f.Name = util.TrimWhitespaces(f.Name)
-	f.Description = util.TrimWhitespaces(f.Description)
+	f.Description = p.Sanitize(util.TrimWhitespaces(f.Description))
 	f.Magnet = util.TrimWhitespaces(f.Magnet)
 
 	if len(f.Name) == 0 {

router/uploadHandler.go

@@ -33,7 +33,7 @@ func UploadHandler(w http.ResponseWriter, r *http.Request) {
 				Status:       1,
 				Hash:         uploadForm.Infohash,
 				Date:         time.Now().Unix(),
-				Description:  []byte{},
+				Description:  uploadForm.Description,
 				Comments:     []byte{}}
 			fmt.Printf("%+v\n", torrent)
 			db.ORM.Create(&torrent)