Merge branch 'release/0704' of git.yoho.cn:fe/yohobuywap-node into release/0704

@@ -5,6 +5,7 @@ const semver = require('semver');
 const questionModel = require('../models/question');
 const headerModel = require('../../../doraemon/models/header'); // 头部model
 const geetest = require('../../passport/controllers/geetest');
+const cleanHtml = require('../../../utils/cleanHtml');
 
 exports.list = (req, res, next) => {
     let canShare = false;
@@ -92,6 +93,15 @@ exports.submit = (req, res, next) => {
         params.sourceType = 'PC';
     }
 
+    let frontAnswers = JSON.parse(params.frontAnswers || '[]') || [];
+
+    _.each(frontAnswers, item => {
+        if (item.addon) {
+            item.addon = cleanHtml.htmlEncode(item.addon);
+        }
+    });
+
+    params.frontAnswers = JSON.stringify(frontAnswers);
     req.ctx(questionModel).submitQuestion(params).then(result => {
         res.send(result);
     }).catch(next);

@@ -110,11 +110,24 @@ let question = {
         }
         $wrap.slideDown();
     },
+    _validationPartten: function(val) {
+        let validationPartten = /['"<>&\|]|--/g,
+            matchChars,
+            errText;
+
+        if (validationPartten.test(val)) {
+            matchChars = val.match(validationPartten).join(' ');
+            errText = '不可以输入 ' + matchChars + ' 哦!';
+        }
+
+        return errText;
+    },
     packAnswersInfo: function() {
         let that = this;
         let answer = [];
         let $errDom;
 
+
         this.$item.each(function() {
             let $this = $(this);
 
@@ -136,13 +149,12 @@ let question = {
                             answerIndex: ans.length,
                             addon: val
                         });
+                        errText = that._validationPartten(val);
                     }
 
                     if (val.length > 400) {
                         errText = '输入内容过长';
                     }
-
-
                 });
             } else {
                 $this.find('.on').each(function() {
@@ -155,6 +167,7 @@ let question = {
 
                     if ($input && $input.length) {
                         a.addon = $input.val();
+                        errText = that._validationPartten(a.addon);
                     }
 
                     ans.push(a);