fixed #68 #75 remove html script
Merge branch 'master' of github.com:cnodejs/nodeclub
dont escape \"
escape "
Update public/libs/showdown.js

干掉了因为a标签的href注入
Update public/libs/showdown.js
Merge pull request #79 from DoubleSpout/master

a标签href注入
判断文件上传路径
判断文件上传路径
Update controllers/upload.js

解决file的相对路径的漏洞，将用户提交的filename进行sha1加密，彻底解决
add test for path problem
don't gen preview every keypress
xss过滤，双引号及正则验证
add test for xss escape
clear test
add mongodb services
Update controllers/user.js

解决头像url被注入bug
Merge pull request #84 from DoubleSpout/master

upload的漏洞和头像url的注入
fixed avatar url bug
fixed avatar_url