4 files changed, 68 insertions, 23 deletions
diff --git a/modules/base/markdown.go b/modules/base/markdown.go
index a3db15df..cb083200 100644
--- a/modules/base/markdown.go
+++ b/modules/base/markdown.go
@@ -13,7 +13,8 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/gogits/gfm"
+	"github.com/russross/blackfriday"
+
 	"github.com/gogits/gogs/modules/setting"
 )
 
@@ -74,7 +75,7 @@ func IsReadmeFile(name string) bool {
 }
 
 type CustomRender struct {
-	gfm.Renderer
+	blackfriday.Renderer
 	urlPrefix string
 }
 
@@ -154,39 +155,40 @@ func RenderSpecialLink(rawBytes []byte, urlPrefix string) []byte {
 
 func RenderRawMarkdown(body []byte, urlPrefix string) []byte {
 	htmlFlags := 0
-	// htmlFlags |= gfm.HTML_USE_XHTML
-	// htmlFlags |= gfm.HTML_USE_SMARTYPANTS
-	// htmlFlags |= gfm.HTML_SMARTYPANTS_FRACTIONS
-	// htmlFlags |= gfm.HTML_SMARTYPANTS_LATEX_DASHES
-	// htmlFlags |= gfm.HTML_SKIP_HTML
-	htmlFlags |= gfm.HTML_SKIP_STYLE
-	htmlFlags |= gfm.HTML_SKIP_SCRIPT
-	htmlFlags |= gfm.HTML_GITHUB_BLOCKCODE
-	htmlFlags |= gfm.HTML_OMIT_CONTENTS
-	// htmlFlags |= gfm.HTML_COMPLETE_PAGE
+	// htmlFlags |= blackfriday.HTML_USE_XHTML
+	// htmlFlags |= blackfriday.HTML_USE_SMARTYPANTS
+	// htmlFlags |= blackfriday.HTML_SMARTYPANTS_FRACTIONS
+	// htmlFlags |= blackfriday.HTML_SMARTYPANTS_LATEX_DASHES
+	// htmlFlags |= blackfriday.HTML_SKIP_HTML
+	htmlFlags |= blackfriday.HTML_SKIP_STYLE
+	// htmlFlags |= blackfriday.HTML_SKIP_SCRIPT
+	// htmlFlags |= blackfriday.HTML_GITHUB_BLOCKCODE
+	htmlFlags |= blackfriday.HTML_OMIT_CONTENTS
+	// htmlFlags |= blackfriday.HTML_COMPLETE_PAGE
 	renderer := &CustomRender{
-		Renderer:  gfm.HtmlRenderer(htmlFlags, "", ""),
+		Renderer:  blackfriday.HtmlRenderer(htmlFlags, "", ""),
 		urlPrefix: urlPrefix,
 	}
 
 	// set up the parser
 	extensions := 0
-	extensions |= gfm.EXTENSION_NO_INTRA_EMPHASIS
-	extensions |= gfm.EXTENSION_TABLES
-	extensions |= gfm.EXTENSION_FENCED_CODE
-	extensions |= gfm.EXTENSION_AUTOLINK
-	extensions |= gfm.EXTENSION_STRIKETHROUGH
-	extensions |= gfm.EXTENSION_HARD_LINE_BREAK
-	extensions |= gfm.EXTENSION_SPACE_HEADERS
-	extensions |= gfm.EXTENSION_NO_EMPTY_LINE_BEFORE_BLOCK
-
-	body = gfm.Markdown(body, renderer, extensions)
+	extensions |= blackfriday.EXTENSION_NO_INTRA_EMPHASIS
+	extensions |= blackfriday.EXTENSION_TABLES
+	extensions |= blackfriday.EXTENSION_FENCED_CODE
+	extensions |= blackfriday.EXTENSION_AUTOLINK
+	extensions |= blackfriday.EXTENSION_STRIKETHROUGH
+	extensions |= blackfriday.EXTENSION_HARD_LINE_BREAK
+	extensions |= blackfriday.EXTENSION_SPACE_HEADERS
+	extensions |= blackfriday.EXTENSION_NO_EMPTY_LINE_BEFORE_BLOCK
+
+	body = blackfriday.Markdown(body, renderer, extensions)
 	return body
 }
 
 func RenderMarkdown(rawBytes []byte, urlPrefix string) []byte {
 	body := RenderSpecialLink(rawBytes, urlPrefix)
 	body = RenderRawMarkdown(body, urlPrefix)
+	body = XSS(body)
 	return body
 }
 
diff --git a/modules/base/tool.go b/modules/base/tool.go
index b4083d09..38fd1e21 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -14,6 +14,7 @@ import (
 	"hash"
 	"html/template"
 	"math"
+	"regexp"
 	"strings"
 	"time"
 
@@ -446,3 +447,29 @@ func DateFormat(t time.Time, format string) string {
 	format = replacer.Replace(format)
 	return t.Format(format)
 }
+
+type xssFilter struct {
+	reg  *regexp.Regexp
+	repl []byte
+}
+
+var (
+	whiteSpace = []byte(" ")
+	xssFilters = []xssFilter{
+		{regexp.MustCompile(`\ [ONon]\w*=["]*`), whiteSpace},
+		{regexp.MustCompile(`<[SCRIPTscript]{6}`), whiteSpace},
+		{regexp.MustCompile(`=[` + "`" + `'"]*[JAVASCRIPTjavascript \t\0&#x0D;]*:`), whiteSpace},
+	}
+)
+
+// XSS goes through all the XSS filters to make user input content as safe as possible.
+func XSS(in []byte) []byte {
+	for _, filter := range xssFilters {
+		in = filter.reg.ReplaceAll(in, filter.repl)
+	}
+	return in
+}
+
+func XSSString(in string) string {
+	return string(XSS([]byte(in)))
+}
diff --git a/modules/git/repo_tag.go b/modules/git/repo_tag.go
index 77ae3db0..ed994d48 100644
--- a/modules/git/repo_tag.go
+++ b/modules/git/repo_tag.go
@@ -22,6 +22,9 @@ func (repo *Repository) IsTagExist(tagName string) bool {
 
 // GetTags returns all tags of given repository.
 func (repo *Repository) GetTags() ([]string, error) {
+	if gitVer.AtLeast(MustParseVersion("2.0.0")) {
+		return repo.getTagsReversed()
+	}
 	stdout, stderr, err := com.ExecCmdDir(repo.Path, "git", "tag", "-l")
 	if err != nil {
 		return nil, errors.New(stderr)
@@ -30,6 +33,15 @@ func (repo *Repository) GetTags() ([]string, error) {
 	return tags[:len(tags)-1], nil
 }
 
+func (repo *Repository) getTagsReversed() ([]string, error) {
+	stdout, stderr, err := com.ExecCmdDir(repo.Path, "git", "tag", "-l", "--sort=-v:refname")
+	if err != nil {
+		return nil, errors.New(stderr)
+	}
+	tags := strings.Split(stdout, "\n")
+	return tags[:len(tags)-1], nil
+}
+
 func (repo *Repository) CreateTag(tagName, idStr string) error {
 	_, stderr, err := com.ExecCmdDir(repo.Path, "git", "tag", tagName, idStr)
 	if err != nil {
diff --git a/modules/git/version.go b/modules/git/version.go
index 9908d11e..b535521e 100644
--- a/modules/git/version.go
+++ b/modules/git/version.go
@@ -74,6 +74,10 @@ func (v *Version) LessThan(that *Version) bool {
 	return v.Compare(that) < 0
 }
 
+func (v *Version) AtLeast(that *Version) bool {
+	return v.Compare(that) >= 0
+}
+
 // GetVersion returns current Git version installed.
 func GetVersion() (*Version, error) {
 	if gitVer != nil {