fix a xss bug
fix word wrap
disable source of editor