From e359e0788d4d9c675a88daaebda416f38e2ac03a Mon Sep 17 00:00:00 2001
From: Vitaly Takmazov
Date: Sun, 7 Apr 2019 01:59:33 +0300
Subject: Tags should be unescaped before storing

Test tag is Test tag
---
 src/main/java/com/juick/server/CommandsManager.java      | 3 ++-
 src/main/java/com/juick/service/MessagesServiceImpl.java | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/main/java/com')

diff --git a/src/main/java/com/juick/server/CommandsManager.java b/src/main/java/com/juick/server/CommandsManager.java
index f6f29941..fdea0d83 100644
--- a/src/main/java/com/juick/server/CommandsManager.java
+++ b/src/main/java/com/juick/server/CommandsManager.java
@@ -35,6 +35,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.math.NumberUtils;
 import org.apache.commons.lang3.reflect.MethodUtils;
 import org.apache.commons.lang3.tuple.Pair;
+import org.apache.commons.text.StringEscapeUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
@@ -91,7 +92,7 @@ public class CommandsManager {
         if (strippedData.startsWith("?OTR")) {
             return CommandResult.fromString("?OTR Error: we are not using OTR");
         }
-        String input = MessageUtils.stripNonSafeUrls(strippedData);
+        String input = StringEscapeUtils.unescapeHtml4(MessageUtils.stripNonSafeUrls(strippedData));
         Optional<Method> cmd = MethodUtils.getMethodsListWithAnnotation(getClass(), UserCommand.class).stream()
                 .filter(m -> Pattern.compile(m.getAnnotation(UserCommand.class).pattern(),
                         m.getAnnotation(UserCommand.class).patternFlags()).matcher(input).matches())
diff --git a/src/main/java/com/juick/service/MessagesServiceImpl.java b/src/main/java/com/juick/service/MessagesServiceImpl.java
index 3e09d204..2bae04e6 100644
--- a/src/main/java/com/juick/service/MessagesServiceImpl.java
+++ b/src/main/java/com/juick/service/MessagesServiceImpl.java
@@ -765,7 +765,7 @@ public class MessagesServiceImpl extends BaseJdbcService implements MessagesServ
 
         return getNamedParameterJdbcTemplate().queryForList(
                 "SELECT messages.message_id FROM messages_tags INNER JOIN messages " +
-                        " USING (message_id) WHERE messages.user_id = :uid AND messages_tags.tag_id = :tid " +
+                        " ON messages.message_id = messages_tags.message_id WHERE messages.user_id = :uid AND messages_tags.tag_id = :tid " +
                         (before > 0 ?
                                 " AND messages.message_id < :before " : StringUtils.EMPTY) +
                         " AND messages.privacy >= :privacy ORDER BY messages.message_id DESC LIMIT 20",
-- 
cgit v1.2.3