Merge branch 'bug/fix-XSS-on-event-title' into 'master'

Make sure title is properly sanitized

Closes #247

See merge request framasoft/mobilizon!281

lib/mobilizon_web/api/events.ex

@@ -73,7 +73,7 @@ defmodule MobilizonWeb.API.Events do
 
   defp prepare_args(args) do
     with %Actor{} = organizer_actor <- Map.get(args, :organizer_actor),
-         title <- args |> Map.get(:title, "") |> String.trim(),
+         title <- args |> Map.get(:title, "") |> HtmlSanitizeEx.strip_tags() |> String.trim(),
          visibility <- Map.get(args, :visibility, :public),
          description <- Map.get(args, :description),
          tags <- Map.get(args, :tags),