From 2400dfc83ad50011965a6fe80e5d8fddfd9a024e Mon Sep 17 00:00:00 2001
From: wangyidong <wangyidong@cnezsoft.com>
Date: Wed, 1 Jun 2022 14:48:35 +0800
Subject: [PATCH]  * code for task #55568.

---
 module/bug/model.php       | 10 ++++++++++
 module/execution/model.php | 10 ++++++++++
 module/product/model.php   |  7 +++++--
 module/project/model.php   | 23 ++++++++++++++++++++++-
 module/story/model.php     |  9 ++++++++-
 module/task/model.php      | 16 ++++++++++++++++
 module/testcase/model.php  |  6 ++++++
 module/testtask/model.php  |  6 ++++++
 8 files changed, 83 insertions(+), 4 deletions(-)

diff --git a/module/bug/model.php b/module/bug/model.php
index 393a42c28a..7225a3ea8c 100644
--- a/module/bug/model.php
+++ b/module/bug/model.php
@@ -938,10 +938,12 @@ class bugModel extends model
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
             ->setDefault('assignedDate', $now)
+            ->stripTags($this->config->bug->editor->assignto['id'], $this->config->allowedTags)
             ->remove('comment,showModule')
             ->join('mailto', ',')
             ->get();
 
+        $bug = $this->loadModel('file')->processImgURL($bug, $this->config->bug->editor->assignto['id'], $this->post->uid);
         $this->dao->update(TABLE_BUG)
             ->data($bug)
             ->autoCheck()
@@ -973,10 +975,12 @@ class bugModel extends model
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
             ->setDefault('assignedDate', $now)
+            ->stripTags($this->config->bug->editor->confirmbug['id'], $this->config->allowedTags)
             ->remove('comment')
             ->join('mailto', ',')
             ->get();
 
+        $bug = $this->loadModel('file')->processImgURL($bug, $this->config->bug->editor->confirmbug['id'], $this->post->uid);
         $this->dao->update(TABLE_BUG)->data($bug)->autoCheck()->checkFlow()->where('id')->eq($bugID)->exec();
 
         if(!dao::isError())
@@ -1044,8 +1048,10 @@ class bugModel extends model
             ->setDefault('resolvedDate',   $now)
             ->setDefault('assignedTo',     $oldBug->openedBy)
             ->removeIF($this->post->resolution != 'duplicate', 'duplicateBug')
+            ->stripTags($this->config->bug->editor->resolve['id'], $this->config->allowedTags)
             ->remove('files,labels')
             ->get();
+        $bug = $this->loadModel('file')->processImgURL($bug, $this->config->bug->editor->resolve['id'], $this->post->uid);
 
         /* Set comment lang for alert error. */
         $this->lang->bug->comment = $this->lang->comment;
@@ -1319,6 +1325,7 @@ class bugModel extends model
             ->setDefault('lastEditedDate', $now)
             ->setDefault('activatedDate',  $now)
             ->setDefault('activatedCount', (int)$oldBug->activatedCount)
+            ->stripTags($this->config->bug->editor->activate['id'], $this->config->allowedTags)
             ->add('id', $bugID)
             ->add('resolution', '')
             ->add('status', 'active')
@@ -1334,6 +1341,7 @@ class bugModel extends model
             ->remove('comment,files,labels')
             ->get();
 
+        $bug = $this->loadModel('file')->processImgURL($bug, $this->config->bug->editor->activate['id'], $this->post->uid);
         $this->dao->update(TABLE_BUG)->data($bug)->autoCheck()->checkFlow()->where('id')->eq((int)$bugID)->exec();
         $this->dao->update(TABLE_BUG)->set('activatedCount = activatedCount + 1')->where('id')->eq((int)$bugID)->exec();
 
@@ -1380,9 +1388,11 @@ class bugModel extends model
             ->setDefault('lastEditedDate', $now)
             ->setDefault('closedBy',       $this->app->user->account)
             ->setDefault('closedDate',     $now)
+            ->stripTags($this->config->bug->editor->close['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
+        $bug = $this->loadModel('file')->processImgURL($bug, $this->config->bug->editor->close['id'], $this->post->uid);
         $this->dao->update(TABLE_BUG)->data($bug)->autoCheck()->checkFlow()->where('id')->eq((int)$bugID)->exec();
         if($oldBug->execution)
         {
diff --git a/module/execution/model.php b/module/execution/model.php
index 5f8e1727b2..fc027051bf 100644
--- a/module/execution/model.php
+++ b/module/execution/model.php
@@ -815,9 +815,11 @@ class executionModel extends model
             ->setDefault('status', 'doing')
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
+            ->stripTags($this->config->execution->editor->start['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
+        $execution = $this->loadModel('file')->processImgURL($execution, $this->config->execution->editor->start['id'], $this->post->uid);
         $this->dao->update(TABLE_EXECUTION)->data($execution)
             ->autoCheck()
             ->check($this->config->execution->start->requiredFields, 'notempty')
@@ -846,6 +848,7 @@ class executionModel extends model
 
         $execution = fixer::input('post')
             ->add('id', $executionID)
+            ->stripTags($this->config->execution->editor->putoff['id'], $this->config->allowedTags)
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
             ->remove('comment')
@@ -854,6 +857,7 @@ class executionModel extends model
         if($this->config->systemMode == 'new') $this->checkBeginAndEndDate($oldExecution->project, $execution->begin, $execution->end);
         if(dao::isError()) return false;
 
+        $execution = $this->loadModel('file')->processImgURL($execution, $this->config->execution->editor->putoff['id'], $this->post->uid);
         $this->dao->update(TABLE_EXECUTION)->data($execution)
             ->autoCheck()
             ->checkFlow()
@@ -881,8 +885,10 @@ class executionModel extends model
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
             ->setDefault('suspendedDate', helper::today())
+            ->stripTags($this->config->execution->editor->suspend['id'], $this->config->allowedTags)
             ->remove('comment')->get();
 
+        $execution = $this->loadModel('file')->processImgURL($execution, $this->config->execution->editor->suspend['id'], $this->post->uid);
         $this->dao->update(TABLE_EXECUTION)->data($execution)
             ->autoCheck()
             ->checkFlow()
@@ -910,6 +916,7 @@ class executionModel extends model
             ->setDefault('status', 'doing')
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
+            ->stripTags($this->config->execution->editor->activate['id'], $this->config->allowedTags)
             ->remove('comment,readjustTime,readjustTask')
             ->get();
 
@@ -919,6 +926,7 @@ class executionModel extends model
             unset($execution->end);
         }
 
+        $execution = $this->loadModel('file')->processImgURL($execution, $this->config->execution->editor->activate['id'], $this->post->uid);
         $this->dao->update(TABLE_EXECUTION)->data($execution)
             ->autoCheck()
             ->checkFlow()
@@ -992,11 +1000,13 @@ class executionModel extends model
             ->setDefault('closedDate', $now)
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
+            ->stripTags($this->config->execution->editor->close['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
         $this->lang->error->ge = $this->lang->execution->ge;
 
+        $execution = $this->loadModel('file')->processImgURL($execution, $this->config->execution->editor->close['id'], $this->post->uid);
         $this->dao->update(TABLE_EXECUTION)->data($execution)
             ->autoCheck()
             ->check($this->config->execution->close->requiredFields,'notempty')
diff --git a/module/product/model.php b/module/product/model.php
index a2eabf8c8b..79c49b78d5 100644
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -864,11 +864,14 @@ class productModel extends model
     {
         $oldProduct = $this->getById($productID);
         $now        = helper::now();
-        $product= fixer::input('post')
+        $product    = fixer::input('post')
             ->add('id', $productID)
             ->setDefault('status', 'closed')
-            ->remove('comment')->get();
+            ->stripTags($this->config->product->editor->close['id'], $this->config->allowedTags)
+            ->remove('comment')
+            ->get();
 
+        $product = $this->loadModel('file')->processImgURL($product, $this->config->product->editor->close['id'], $this->post->uid);
         $this->dao->update(TABLE_PRODUCT)->data($product)
             ->autoCheck()
             ->checkFlow()
diff --git a/module/project/model.php b/module/project/model.php
index 86027b4422..ad0f4503d1 100644
--- a/module/project/model.php
+++ b/module/project/model.php
@@ -1559,13 +1559,18 @@ class projectModel extends model
         $oldProject = $this->getById($projectID, $type);
         $now        = helper::now();
 
+        $editorIdList = $this->config->project->editor->start['id'];
+        if($this->app->rawModule == 'program') $editorIdList = $this->config->program->editor->start['id'];
+
         $project = fixer::input('post')
             ->add('id', $projectID)
             ->setDefault('status', 'doing')
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
+            ->stripTags($editorIdList, $this->config->allowedTags)
             ->remove('comment')->get();
 
+        $project = $this->loadModel('file')->processImgURL($project, $editorIdList, $this->post->uid);
         $this->dao->update(TABLE_PROJECT)->data($project)
             ->autoCheck()
             ->check($this->config->project->start->requiredFields, 'notempty')
@@ -1617,15 +1622,20 @@ class projectModel extends model
      */
     public function suspend($projectID)
     {
+        $editorIdList = $this->config->project->editor->suspend['id'];
+        if($this->app->rawModule == 'program') $editorIdList = $this->config->program->editor->suspend['id'];
+
         $oldProject = $this->getById($projectID);
-        $project = fixer::input('post')
+        $project    = fixer::input('post')
             ->add('id', $projectID)
             ->setDefault('status', 'suspended')
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', helper::now())
             ->setDefault('suspendedDate', helper::today())
+            ->stripTags($editorIdList, $this->config->allowedTags)
             ->remove('comment')->get();
 
+        $project = $this->loadModel('file')->processImgURL($project, $editorIdList, $this->post->uid);
         $this->dao->update(TABLE_PROJECT)->data($project)
             ->autoCheck()
             ->checkFlow()
@@ -1647,6 +1657,9 @@ class projectModel extends model
         $oldProject = $this->getById($projectID);
         $now        = helper::now();
 
+        $editorIdList = $this->config->project->editor->activate['id'];
+        if($this->app->rawModule == 'program') $editorIdList = $this->config->program->editor->activate['id'];
+
         $project = fixer::input('post')
             ->add('id', $projectID)
             ->setDefault('realEnd','')
@@ -1654,6 +1667,7 @@ class projectModel extends model
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
             ->setIF($oldProject->realBegan == '0000-00-00', 'realBegan', helper::today())
+            ->stripTags($editorIdList, $this->config->allowedTags)
             ->remove('comment,readjustTime,readjustTask')
             ->get();
 
@@ -1663,6 +1677,7 @@ class projectModel extends model
             unset($project->end);
         }
 
+        $project = $this->loadModel('file')->processImgURL($project, $editorIdList, $this->post->uid);
         $this->dao->update(TABLE_PROJECT)->data($project)
             ->autoCheck()
             ->checkFlow()
@@ -1719,6 +1734,9 @@ class projectModel extends model
         $oldProject = $this->getById($projectID);
         $now        = helper::now();
 
+        $editorIdList = $this->config->project->editor->close['id'];
+        if($this->app->rawModule == 'program') $editorIdList = $this->config->program->editor->close['id'];
+
         $project = fixer::input('post')
             ->add('id', $projectID)
             ->setDefault('status', 'closed')
@@ -1726,11 +1744,14 @@ class projectModel extends model
             ->setDefault('closedDate', $now)
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
+            ->stripTags($editorIdList, $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
         $this->lang->error->ge = $this->lang->project->ge;
 
+        $project = $this->loadModel('file')->processImgURL($project, $editorIdList, $this->post->uid);
+
         $this->dao->update(TABLE_PROJECT)->data($project)
             ->autoCheck()
             ->check($this->config->project->close->requiredFields, 'notempty')
diff --git a/module/story/model.php b/module/story/model.php
index 5cab21203e..349e454cf1 100644
--- a/module/story/model.php
+++ b/module/story/model.php
@@ -830,7 +830,6 @@ class storyModel extends model
         if(isset($story->stage) and $oldStory->stage != $story->stage) $story->stagedBy = (strpos('tested|verified|released|closed', $story->stage) !== false) ? $this->app->user->account : '';
         $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->edit['id'], $this->post->uid);
 
-
         if(isset($_POST['reviewer']))
         {
             $_POST['reviewer'] = array_filter($_POST['reviewer']);
@@ -1327,6 +1326,7 @@ class storyModel extends model
             ->setDefault('lastEditedDate', $now)
             ->setDefault('status', $oldStory->status)
             ->setDefault('reviewedDate', $date)
+            ->stripTags($this->config->story->editor->review['id'], $this->config->allowedTags)
             ->setIF($this->post->result == 'revert', 'version', $this->post->preVersion)
             ->removeIF($this->post->result != 'reject', 'closedReason, duplicateStory, childStories')
             ->removeIF($this->post->result == 'reject' and $this->post->closedReason != 'duplicate', 'duplicateStory')
@@ -1335,6 +1335,7 @@ class storyModel extends model
             ->add('id', $storyID)
             ->remove('result,preVersion,comment')
             ->get();
+        $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->review['id'], $this->post->uid);
 
         /* Fix bug #671. */
         $this->lang->story->closedReason = $this->lang->story->rejectedReason;
@@ -1562,6 +1563,7 @@ class storyModel extends model
             ->setDefault('closedDate',     $now)
             ->setDefault('closedBy',       $this->app->user->account)
             ->setDefault('assignedDate',   $now)
+            ->stripTags($this->config->story->editor->close['id'], $this->config->allowedTags)
             ->removeIF($this->post->closedReason != 'duplicate', 'duplicateStory')
             ->removeIF($this->post->closedReason != 'subdivided', 'childStories')
             ->get();
@@ -1577,6 +1579,7 @@ class storyModel extends model
         }
 
         $this->lang->story->comment = $this->lang->comment;
+        $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->close['id'], $this->post->uid);
         $this->dao->update(TABLE_STORY)->data($story, 'comment')
             ->autoCheck()
             ->batchCheck($this->config->story->close->requiredFields, 'notempty')
@@ -1990,9 +1993,11 @@ class storyModel extends model
             ->add('lastEditedBy', $this->app->user->account)
             ->add('lastEditedDate', $now)
             ->add('assignedDate', $now)
+            ->stripTags($this->config->story->editor->assignto['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
+        $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->assignto['id'], $this->post->uid);
         $this->dao->update(TABLE_STORY)->data($story)->autoCheck()->checkFlow()->where('id')->eq((int)$storyID)->exec();
         if(!dao::isError()) return common::createChanges($oldStory, $story);
         return false;
@@ -2053,8 +2058,10 @@ class storyModel extends model
             ->setDefault('lastEditedDate', $now)
             ->setDefault('assignedDate',   $now)
             ->setDefault('activatedDate', $now)
+            ->stripTags($this->config->story->editor->activate['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
+        $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->activate['id'], $this->post->uid);
         $this->dao->update(TABLE_STORY)->data($story)->autoCheck()->checkFlow()->where('id')->eq($storyID)->exec();
 
         if($this->post->status == 'active') $this->dao->delete()->from(TABLE_STORYREVIEW)->where('story')->eq($storyID)->exec();
diff --git a/module/task/model.php b/module/task/model.php
index 40de45d730..e196488f0e 100644
--- a/module/task/model.php
+++ b/module/task/model.php
@@ -1459,6 +1459,7 @@ class taskModel extends model
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
             ->setDefault('assignedDate', $now)
+            ->stripTags($this->config->task->editor->assignto['id'], $this->config->allowedTags)
             ->remove('comment,showModule')
             ->get();
         if($oldTask->status != 'done' and $oldTask->status != 'closed' and isset($task->left) and $task->left == 0)
@@ -1483,6 +1484,7 @@ class taskModel extends model
 
         if($oldTask->parent > 0) $this->updateParentStatus($taskID);
 
+        $task = $this->file->processImgURL($task, $this->config->task->editor->assignto['id'], $this->post->uid);
         $this->dao->update(TABLE_TASK)
             ->data($task)
             ->autoCheck()
@@ -1519,6 +1521,8 @@ class taskModel extends model
         }
         if(dao::isError()) return false;
 
+        $editorIdList = $this->config->task->editor->start['id'];
+        if($this->app->getMethodName() == 'restart') $editorIdList = $this->config->task->editor->restart['id'];
         $now  = helper::now();
         $task = fixer::input('post')
             ->add('id', $taskID)
@@ -1526,9 +1530,11 @@ class taskModel extends model
             ->setDefault('lastEditedDate', $now)
             ->setDefault('status', 'doing')
             ->setIF($oldTask->assignedTo != $this->app->user->account, 'assignedDate', $now)
+            ->stripTags($editorIdList, $this->config->allowedTags)
             ->removeIF(!empty($oldTask->team), 'consumed,left')
             ->remove('comment')->get();
 
+        $task = $this->file->processImgURL($task, $editorIdList, $this->post->uid);
         if($this->post->left == 0)
         {
             if(isset($task->consumed) and $task->consumed == 0)
@@ -1757,6 +1763,7 @@ class taskModel extends model
             ->setDefault('status', 'done')
             ->setDefault('finishedBy, lastEditedBy', $this->app->user->account)
             ->setDefault('finishedDate, lastEditedDate', $now)
+            ->stripTags($this->config->task->editor->finish['id'], $this->config->allowedTags)
             ->removeIF(!empty($oldTask->team), 'finishedBy,status,left')
             ->remove('comment,files,labels,currentConsumed')
             ->get();
@@ -1851,6 +1858,7 @@ class taskModel extends model
 
         if($task->finishedDate == substr($now, 0, 10)) $task->finishedDate = $now;
 
+        $task = $this->file->processImgURL($task, $this->config->task->editor->finish['id'], $this->post->uid);
         $this->dao->update(TABLE_TASK)->data($task)
             ->autoCheck()
             ->checkFlow()
@@ -1890,9 +1898,11 @@ class taskModel extends model
             ->setDefault('status', 'pause')
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', helper::now())
+            ->stripTags($this->config->task->editor->pause['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
+        $task = $this->file->processImgURL($task, $this->config->task->editor->pause['id'], $this->post->uid);
         $this->dao->update(TABLE_TASK)->data($task)->autoCheck()->checkFlow()->where('id')->eq((int)$taskID)->exec();
 
         if($oldTask->parent > 0) $this->updateParentStatus($taskID);
@@ -1926,12 +1936,14 @@ class taskModel extends model
             ->setDefault('assignedDate', $now)
             ->setDefault('closedBy, lastEditedBy', $this->app->user->account)
             ->setDefault('closedDate, lastEditedDate', $now)
+            ->stripTags($this->config->task->editor->close['id'], $this->config->allowedTags)
             ->setIF($oldTask->status == 'done',   'closedReason', 'done')
             ->setIF($oldTask->status == 'cancel', 'closedReason', 'cancel')
             ->remove('_recPerPage')
             ->remove('comment')
             ->get();
 
+        $task = $this->file->processImgURL($task, $this->config->task->editor->close['id'], $this->post->uid);
         $this->dao->update(TABLE_TASK)->data($task)->autoCheck()->checkFlow()->where('id')->eq((int)$taskID)->exec();
 
         if(!dao::isError())
@@ -1974,9 +1986,11 @@ class taskModel extends model
             ->setDefault('finishedDate', '0000-00-00')
             ->setDefault('canceledBy, lastEditedBy', $this->app->user->account)
             ->setDefault('canceledDate, lastEditedDate', $now)
+            ->stripTags($this->config->task->editor->cancel['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
+        $task = $this->file->processImgURL($task, $this->config->task->editor->cancel['id'], $this->post->uid);
         $this->dao->update(TABLE_TASK)->data($task)->autoCheck()->checkFlow()->where('id')->eq((int)$taskID)->exec();
         if($oldTask->fromBug) $this->dao->update(TABLE_BUG)->set('toTask')->eq(0)->where('id')->eq($oldTask->fromBug)->exec();
         if($oldTask->parent > 0) $this->updateParentStatus($taskID);
@@ -2038,6 +2052,7 @@ class taskModel extends model
             ->setDefault('lastEditedDate', helper::now())
             ->setDefault('assignedDate', helper::now())
             ->setDefault('activatedDate', helper::now())
+            ->stripTags($this->config->task->editor->activate['id'], $this->config->allowedTags)
             ->remove('comment')
             ->get();
 
@@ -2058,6 +2073,7 @@ class taskModel extends model
             $task = $this->computeHours4Multiple($oldTask, $task);
         }
 
+        $task = $this->file->processImgURL($task, $this->config->task->editor->activate['id'], $this->post->uid);
         $this->dao->update(TABLE_TASK)->data($task)
             ->autoCheck()
             ->batchCheck($this->config->task->activate->requiredFields, 'notempty')
diff --git a/module/testcase/model.php b/module/testcase/model.php
index 8214d2bba0..31d44cc61a 100644
--- a/module/testcase/model.php
+++ b/module/testcase/model.php
@@ -61,6 +61,7 @@ class testcaseModel extends model
             ->setIF($this->config->systemMode == 'new' and $this->app->tab == 'project', 'project', $this->session->project)
             ->setIF($this->app->tab == 'execution', 'execution', $this->session->execution)
             ->setIF($this->post->story != false, 'storyVersion', $this->loadModel('story')->getVersion((int)$this->post->story))
+            ->stripTags($this->config->testcase->editor->create['id'], $this->config->allowedTags)
             ->remove('steps,expects,files,labels,stepType,forceNotReview')
             ->setDefault('story', 0)
             ->cleanInt('story,product,branch,module')
@@ -77,6 +78,7 @@ class testcaseModel extends model
 
         /* Value of story may be showmore. */
         $case->story = (int)$case->story;
+        $case = $this->loadModel('file')->processImgURL($case, $this->config->testcase->editor->create['id'], $this->post->uid);
         $this->dao->insert(TABLE_CASE)->data($case)->autoCheck()->batchCheck($this->config->testcase->create->requiredFields, 'notempty')->checkFlow()->exec();
         if(!$this->dao->isError())
         {
@@ -749,6 +751,7 @@ class testcaseModel extends model
             ->join('linkCase', ',')
             ->setForce('status', $status)
             ->cleanInt('story,product,branch,module')
+            ->stripTags($this->config->testcase->editor->edit['id'], $this->config->allowedTags)
             ->remove('comment,steps,expects,files,labels,stepType')
             ->get();
 
@@ -761,6 +764,7 @@ class testcaseModel extends model
             array_splice($requiredFieldsArr, $fieldIndex, 1);
             $requiredFields    = implode(',', $requiredFieldsArr);
         }
+        $case = $this->loadModel('file')->processImgURL($case, $this->config->testcase->editor->edit['id'], $this->post->uid);
         $this->dao->update(TABLE_CASE)->data($case)->autoCheck()->batchCheck($requiredFields, 'notempty')->checkFlow()->where('id')->eq((int)$caseID)->exec();
         if(!$this->dao->isError())
         {
@@ -864,10 +868,12 @@ class testcaseModel extends model
             ->setDefault('reviewedDate', substr($now, 0, 10))
             ->setDefault('lastEditedBy', $this->app->user->account)
             ->setDefault('lastEditedDate', $now)
+            ->stripTags($this->config->testcase->editor->review['id'], $this->config->allowedTags)
             ->setForce('status', $status)
             ->join('reviewedBy', ',')
             ->get();
 
+        $case = $this->loadModel('file')->processImgURL($case, $this->config->testcase->editor->review['id'], $this->post->uid);
         $this->dao->update(TABLE_CASE)->data($case)->autoCheck()->checkFlow()->where('id')->eq($caseID)->exec();
 
         if(dao::isError()) return false;
diff --git a/module/testtask/model.php b/module/testtask/model.php
index 6946e7f513..210568b3d7 100644
--- a/module/testtask/model.php
+++ b/module/testtask/model.php
@@ -772,8 +772,10 @@ class testtaskModel extends model
         $testtask = fixer::input('post')
             ->add('id', $taskID)
             ->setDefault('status', 'doing')
+            ->stripTags($this->config->testtask->editor->start['id'], $this->config->allowedTags)
             ->remove('comment')->get();
 
+        $testtask = $this->loadModel('file')->processImgURL($testtask, $this->config->testtask->editor->start['id'], $this->post->uid);
         $this->dao->update(TABLE_TESTTASK)->data($testtask)
             ->autoCheck()
             ->checkFlow()
@@ -838,8 +840,10 @@ class testtaskModel extends model
         $testtask = fixer::input('post')
             ->add('id', $taskID)
             ->setDefault('status', 'blocked')
+            ->stripTags($this->config->testtask->editor->block['id'], $this->config->allowedTags)
             ->remove('comment')->get();
 
+        $testtask = $this->loadModel('file')->processImgURL($testtask, $this->config->testtask->editor->block['id'], $this->post->uid);
         $this->dao->update(TABLE_TESTTASK)->data($testtask)
             ->autoCheck()
             ->checkFlow()
@@ -861,8 +865,10 @@ class testtaskModel extends model
         $oldTesttask = $this->getById($taskID);
         $testtask = fixer::input('post')
             ->setDefault('status', 'doing')
+            ->stripTags($this->config->testtask->editor->activate['id'], $this->config->allowedTags)
             ->remove('comment')->get();
 
+        $testtask = $this->loadModel('file')->processImgURL($testtask, $this->config->testtask->editor->activate['id'], $this->post->uid);
         $this->dao->update(TABLE_TESTTASK)->data($testtask)
             ->autoCheck()
             ->checkFlow()