module.exports = function(mongoose) {
    var schema = new mongoose.Schema({
        text:String,
        app:{type:mongoose.Schema.Types.ObjectId,ref:"apps"},
        user:{type:mongoose.Schema.Types.ObjectId,ref:"users"},
        files:[{type:mongoose.Schema.Types.ObjectId,ref:"files"}],
        favoriteCount:{type:Number,default:0},
        replyTo:{type:mongoose.Schema.Types.ObjectId,ref:"posts"}
    },{
        timestamps:true
    })
    schema.methods.toResponseObject = async function (token) {
        var obj = this.toObject()
        obj.id = this._id
        obj._id = undefined
        obj.__v = undefined
        if (this.user.toResponseObject) obj.user=await this.user.toResponseObject(token)
        else {
            this.user = await mongoose.model("users").findById(this.user)
            if (this.user) obj.user = await this.user.toResponseObject(token)
        }
        if (this.app && this.app.toResponseObject) {
            obj.app=await this.app.toResponseObject(token)
            delete obj.app.appKey
            delete obj.app.appSecret
        }
        if (this.files && this.files.length) {
            for (let i=0;i<this.files.length;i++) {
                if (!this.files[i].toResponseObject) {
                    obj.files = []
                    break
                }
                obj.files[i] = await this.files[i].toResponseObject(token)
            }
        }
        if (token) {
            obj.isFavorited = !!(await mongoose.model("favorites").findOne({user:token.user.id,post:this.id}))
        }
        if (this.replyTo && this.replyTo.toResponseObject) obj.replyTo = await this.replyTo.toResponseObject()
        obj.html = obj.text
        obj.html = obj.html.split('&').join("&amp;")
        obj.html = obj.html.split("<").join("&lt;")
        obj.html = obj.html.split(">").join("&gt;")
        // obj.html = obj.html.split('"').join("&quot;")
        obj.html = obj.html.split("\n").join("<br>")
        obj.html = obj.html.replace(/(^| |\u3000)@([A-Za-z0-9_]+)/g,'$1<a href="/u/$2">@$2</a>')
        obj.html = obj.html.replace(/(https?:\/\/[a-zA-Z0-9-\.]+(:[0-9]+)?(\/?[a-zA-Z0-9-\._~\!#$&'\(\)\*\+,\/:;=\?@\[\]%]*))/g,'<a href="$1" rel="nofollow" target="_blank">$1</a>')
        obj.html = obj.html.replace(/moz:\/\/a/,'<a href="https://www.mozilla.org/">moz://a</a>')
        return obj
    }
    return mongoose.model("posts",schema)
}

@@ -2096,20 +2096,22 @@
 (https?:
+)
 %5C/%5C/
+(
 %5Ba-zA-Z0
@@ -2181,16 +2181,54 @@
 %25%5D*))/g,
+function(match) %7B%0A            return (
 '%3Ca href
@@ -2229,18 +2229,25 @@
 a href=%22
-$1
+'+match+'
 %22 rel=%22n
@@ -2275,15 +2275,65 @@
 nk%22%3E
-$1%3C/a%3E'
+'+match+'%3C/a%3E').replace(/%5C/%5C//g,%22&#x2F;&#x2F;%22)%0A        %7D
 )%0A  
@@ -2394,18 +2394,28 @@
 =%22https:
-//
+&#x2F;&#x2F;
 www.mozi
@@ -2428,18 +2428,28 @@
 g/%22%3Emoz:
-//
+&#x2F;&#x2F;
 a%3C/a%3E')%0A

fix bug