Merge remote-tracking branch 'origin/dev' into dev

API.md

@@ -40,6 +40,7 @@
     * [Get block attributes](#Get-block-attributes)
 * [SQL](#SQL)
     * [Execute SQL query](#Execute-SQL-query)
+    * [Flush transaction](#Flush-transaction)
 * [Templates](#Templates)
     * [Render a template](#Render-a-template)
     * [Render Sprig](#Render-Sprig)
@@ -1041,6 +1042,20 @@ Rename a document by `id`:
   }
   ```
 
+### Flush transaction
+
+* `/api/sqlite/flushTransaction`
+* No parameters
+* Return value
+
+  ```json
+  {
+    "code": 0,
+    "msg": "",
+    "data": null
+  }
+  ```
+
 ## Templates
 
 ### Render a template

API_zh_CN.md

@@ -40,6 +40,7 @@
     * [获取块属性](#获取块属性)
 * [SQL](#SQL)
     * [执行 SQL 查询](#执行-SQL-查询)
+    * [提交事务](#提交事务)
 * [模板](#模板)
     * [渲染模板](#渲染模板)
     * [渲染 Sprig](#渲染-Sprig)
@@ -1040,6 +1041,20 @@
     ]
   }
   ```
+  
+### 提交事务
+
+* `/api/sqlite/flushTransaction`
+* 不带参
+* 返回值
+
+  ```json
+  {
+    "code": 0,
+    "msg": "",
+    "data": null
+  }
+  ```
 
 ## 模板
 

kernel/sql/asset.go

@@ -21,9 +21,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/siyuan-note/filelock"
-
 	"github.com/88250/lute/ast"
+	"github.com/siyuan-note/filelock"
 	"github.com/siyuan-note/logging"
 	"github.com/siyuan-note/siyuan/kernel/treenode"
 	"github.com/siyuan-note/siyuan/kernel/util"
@@ -45,14 +44,15 @@ func docTagSpans(n *ast.Node) (ret []*Span) {
 	if tagsVal := n.IALAttr("tags"); "" != tagsVal {
 		tags := strings.Split(tagsVal, ",")
 		for _, tag := range tags {
-			markdown := "#" + tag + "#"
+			escaped := util.EscapeHTML(tag)
+			markdown := "#" + escaped + "#"
 			span := &Span{
 				ID:       ast.NewNodeID(),
 				BlockID:  n.ID,
 				RootID:   n.ID,
 				Box:      n.Box,
 				Path:     n.Path,
-				Content:  tag,
+				Content:  escaped,
 				Markdown: markdown,
 				Type:     "tag",
 				IAL:      "",