Hi there,
The WebIM sample is vulnerable to XSS, specifically the "Chat history" feature.

Whereas the uname parameter is properly handled by the template engine 1, the same is not true when handled and appended to the DOM by the JavaScript 2, 3, 4.

A crafted malicious Username like John <script>alert('Doe')</script> will display an alert box on every users' chat window as soon the new joins the room.

Chat messages suffer from the exact same problem: sending a message like Hello <script>alert('everyone')</script> will trigger an alert box on every users's chat window.

Please consider fixing this issue as many developers may build on top of your sample.

Regards,
Paulo A. Slva

我改了一下routers包的地址 改为github.com/beego/samples/tree/master/WebIM/routers 发现还是不好使 问一下大佬们该如何解决

beego更新了，beego.Info没有了，需要更新

第二次传入同一个url, 的时候这行代码返回值是nil, 不知道是不是cache的bug。
result.UrlShort = urlcache.Get(urlmd5).(string)

2014/09/24 21:44:14 [C] the request url is /v1/shorten
2014/09/24 21:44:14 [C] Handler crashed with error interface conversion: interface is nil, not string
2014/09/24 21:44:14 [C] /usr/local/go/src/pkg/runtime/panic.c:248
2014/09/24 21:44:14 [C] /private/var/folders/00/0sdwh000h01000cxqpysvccm0035qk/T/makerelease530016500/go/src/pkg/runtime/iface.goc:292
2014/09/24 21:44:14 [C] /private/var/folders/00/0sdwh000h01000cxqpysvccm0035qk/T/makerelease530016500/go/src/pkg/runtime/iface.goc:280
2014/09/24 21:44:14 [C] /Users/1/kanbox/gocode/src/shorturl/controllers/short.go:36
2014/09/24 21:44:14 [C] /Users/1/kanbox/gocode/src/github.com/astaxie/beego/router.go:721
2014/09/24 21:44:14 [C] /usr/local/go/src/pkg/net/http/server.go:1673
2014/09/24 21:44:14 [C] /usr/local/go/src/pkg/net/http/server.go:1174
2014/09/24 21:44:14 [C] /usr/local/go/src/pkg/runtime/proc.c:1445

test

Good Day !
i love to work with your project, can i submit my logo design for it ?

2017/11/02 15:59:59 [D] Loading language:
2017/11/02 15:59:59 [E] Fail to set message file: open conf/locale_.ini: no such file or directory
2017/11/02 15:59:59 [I] beego 0.1.1.0227
2017/11/02 15:59:59 [I] http server Running on http://:8080
2017/11/02 16:00:04 [C] the request url is /
2017/11/02 16:00:04 [C] Handler crashed with error can't find templatefile in the path:views/welcome.html
2017/11/02 16:00:04 [C] /usr/local/go/src/runtime/asm_amd64.s:509
2017/11/02 16:00:04 [C] /usr/local/go/src/runtime/panic.go:491
2017/11/02 16:00:04 [C] /data/code/go/src/github.com/astaxie/beego/template.go:73
2017/11/02 16:00:04 [C] /data/code/go/src/github.com/astaxie/beego/controller.go:263
2017/11/02 16:00:04 [C] /data/code/go/src/github.com/astaxie/beego/controller.go:214
2017/11/02 16:00:04 [C] /data/code/go/src/github.com/astaxie/beego/controller.go:194
2017/11/02 16:00:04 [C] /data/code/go/src/github.com/astaxie/beego/router.go:827
2017/11/02 16:00:04 [C] /usr/local/go/src/net/http/server.go:2619
2017/11/02 16:00:04 [C] /usr/local/go/src/net/http/server.go:1801
2017/11/02 16:00:04 [C] /usr/local/go/src/runtime/asm_amd64.s:2337

"This package was replaced by the Gorilla websocket package. Users of this package are encouraged to update to the Gorilla package." from the project README.

https://github.com/garyburd/go-websocket

$ curl -X MKCOL http://127.0.0.1:8080/test
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 19 100 19 0 0 19 0 0:00:01 --:--:-- 0:00:01 19000 Method Not Allowed

我没有找到在什么时候调用chatroom.go中的init()函数，那么聊天室是在什么时候创建的呢？？？

todo 项目运行后 会有一个 2017/04/19 21:10:10 [staticfile.go:61] [W] Can't find the file: static/js/angular.min.js.map stat static/js/angular.min.js.map: no such file or directory

waring不影响运行但是，我想知道原因。谢谢

http://beego.me/docs/Samples_WebIM gives a 404

Hello,

I am new to Beego and I'm really enjoying the framework, I was wondering if it was possible to include a sample that had a database back-end.

There are probably lots of ways to structure this but if a sample included one possible way (the idiomatic way) it would really be helpful for new people.

For example, it would answer some of the following questions (of which I'm unsure about myself).

1. How do I connect my application to a database
2. Where should my CRUD logic go (in the model or in the controller?)

$ go get github.com/gorilla/websocket
$ go get github.com/beego/i18n
执行完这两条指令后目录仍是空的，什么都没有，请问这是怎么回事儿啊？

for ch := waitingList.Back(); ch != nil; ch = ch.Prev() { ch.Value.(chan bool) <- true waitingList.Remove(ch) }
chatroom.go 文件中的第76行---79行的链表循环中删除节点的代码操作是有问题的，节点被删除后继续循环操作导致链表某些元素无法真正的被遍历处理，进而部分聊天室的成员会由于chanel阻塞而无法获取到消息，请处理下。

it looks the import path should changed to be as below:
samples/WebIM/controllers

Goland cannot find the packet from github.