Merge pull request #79 from DoubleSpout/master

a标签href注入
判断文件上传路径
判断文件上传路径
add test for path problem
don't gen preview every keypress
xss过滤，双引号及正则验证
add test for xss escape
clear test
add mongodb services
Merge pull request #84 from DoubleSpout/master

upload的漏洞和头像url的注入
fixed avatar url bug
fixed avatar_url
模板必须使用双引号
fixed #83 sanitize.xss()
Merge remote branch 'cnode/master'
Merge pull request #80 from dead-horse/master

文件上传过滤
fixed reply xss
增加时间做前缀
update authors
Merge remote branch 'cnode/master'