Fixed some newly discovered XSS exploit.

Fixed a missing relation.
Set a default action for message.