diff --git a/‎server/controllers/news.js‎
Lines changed: 11 additions & 3 deletions b/‎server/controllers/news.js‎
Lines changed: 11 additions & 3 deletions
diff --git a/‎server/views/news/show.jade‎
Lines changed: 3 additions & 2 deletions b/‎server/views/news/show.jade‎
Lines changed: 3 additions & 2 deletions
@@ -6,6 +6,7 @@ var cookieParser = require('cookie-parser')();
 var moment = require('moment');
 var pluralize = require('pluralize');
 var expressValidator = require('express-validator');
+var marked = require('marked');
 var Articles = require(path.join(__dirname, '..', 'models', 'articles'));
 var Users = require(path.join(__dirname, '..', 'models', 'users'));
 var Akismetor = require(path.join(__dirname, '..', 'services', 'akismetor'));
@@ -94,15 +95,16 @@ router.
 
     Articles.findBySlug(req.params.slug, function(err, doc) {
       if(doc){
-        res.render('news/show', { doc: doc, user: user, token: req.csrfToken(), moment: moment, pluralize: pluralize });
+        // doc.body = marked(doc.body); // This sync compiling can become costly
+        res.render('news/show', { doc: doc, user: user, token: req.csrfToken(), moment: moment, pluralize: pluralize, marked: marked });
       }else{
         res.render('404');
       }
     });
   }).
 
   post('/:slug([a-zA-Z0-9_.-]+)/comment', cookieParser, authenticator.authorize, parseForm, expressValidator(),  csrfProtection, buildComment, function(req, res) {
-    req.sanitize('body').trim();
+    req.sanitize('body').escape().trim();
     req.check('body').notEmpty();
 
     var errors = req.validationErrors();
@@ -118,7 +120,10 @@ router.
     }
   }).
 
-  put('/:slug([a-zA-Z0-9_.-]+)/comment/:id([a-zA-Z0-9_.-]+)', cookieParser, authenticator.authorize, parseForm, csrfProtection, function(req, res) {
+  put('/:slug([a-zA-Z0-9_.-]+)/comment/:id([a-zA-Z0-9_.-]+)', cookieParser, authenticator.authorize, parseForm, expressValidator(), csrfProtection, function(req, res) {
+    req.sanitize('body').escape().trim();
+    req.check('body').notEmpty();
+
     var args = {
       updatedComment : req.body.body,
       commentId      : req.params.id,
@@ -151,6 +156,9 @@ router.
 
   post('/', cookieParser, authenticator.authorize, parseForm, addhttp, expressValidator(), csrfProtection, function(req, res) {
 
+    req.sanitize('body').escape().trim();
+    req.check('body').notEmpty();
+
     // Validations
     req.check('title','Title is required' ).notEmpty();
     req.check('url', 'URL is required').notEmpty();
 
@@ -33,7 +33,7 @@ block content
               li.list-item
                 a.dib.js-createComment-number.js-editComment-number(href='#comments')= pluralize('Comment', doc.comment_count, true)
 
-        p.well.well--l.tsl= doc.body
+        p.well.well--l.tsl!= marked(doc.body)
 
       - commentsClass = doc.comment_count == 0 ? 'is-empty' : ''
       aside#comments.js-createComment-container(role='complementary' class=commentsClass)
@@ -59,7 +59,8 @@ block content
                           .split-cell
                             button.link.js-editComment-editBtn Edit
 
-                    p.mbf.js-editComment-comment= comment.body
+                    .mbf.js-editComment-comment
+                      != marked(comment.body)
 
                     if comment.user.id == user.id