diff --git a/packages/ui-default/backendlib/template.js b/packages/ui-default/backendlib/template.js
index 1bcc17bd0..dbb8d59b0 100644
--- a/packages/ui-default/backendlib/template.js
+++ b/packages/ui-default/backendlib/template.js
@@ -9,6 +9,7 @@ const argv = require('cac')().parse();
 const { findFileSync } = require('@hydrooj/utils/lib/utils');
 const status = require('@hydrooj/utils/lib/status');
 const markdown = require('./markdown');
+const { xss } = require('./markdown-it-xss');
 
 const { misc, buildContent, avatar } = global.Hydro.lib;
 
@@ -86,7 +87,7 @@ class Nunjucks extends nunjucks.Environment {
         else s = s[langs[0]];
       }
       if (s instanceof Array) s = buildContent(s, html ? 'html' : 'markdown', (str) => str.translate(language));
-      return markdown.render(s);
+      return html ? xss.process(s) : markdown.render(s);
     });
     this.addFilter('log', (self) => {
       console.log(self);
diff --git a/packages/ui-default/package.json b/packages/ui-default/package.json
index 2190d0c81..93e77b78f 100644
--- a/packages/ui-default/package.json
+++ b/packages/ui-default/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.26.4",
+  "version": "4.26.5",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",
diff --git a/packages/ui-default/pages/problem_edit.page.js b/packages/ui-default/pages/problem_edit.page.js
index b5aa29c3f..8c619b9e0 100644
--- a/packages/ui-default/pages/problem_edit.page.js
+++ b/packages/ui-default/pages/problem_edit.page.js
@@ -123,7 +123,7 @@ function buildCategoryFilter() {
       // de-select children
       _.forEach(treeItem.children, (treeSubItem, subcategory) => {
         if (treeSubItem.select) {
-          treeSubItem.select = false; // eslint-disable-line no-param-reassign
+          treeSubItem.select = false;
           dirtyCategories.push({ type: 'subcategory', subcategory, category });
         }
       });
diff --git a/packages/ui-default/pages/problem_main.page.js b/packages/ui-default/pages/problem_main.page.js
index 5c962c5e2..ad65c54fe 100644
--- a/packages/ui-default/pages/problem_main.page.js
+++ b/packages/ui-default/pages/problem_main.page.js
@@ -123,7 +123,7 @@ function buildCategoryFilter() {
       // de-select children
       _.forEach(treeItem.children, (treeSubItem, subcategory) => {
         if (treeSubItem.select) {
-          treeSubItem.select = false; // eslint-disable-line no-param-reassign
+          treeSubItem.select = false;
           dirtyCategories.push({ type: 'subcategory', subcategory, category });
         }
       });
diff --git a/packages/ui-default/templates/problem_main.html b/packages/ui-default/templates/problem_main.html
index 643df12cd..9621521ab 100644
--- a/packages/ui-default/templates/problem_main.html
+++ b/packages/ui-default/templates/problem_main.html
@@ -24,8 +24,8 @@
         </div>
       </div>
     </div>
-    {% if handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
-      <div class="medium-3 columns">
+    <div class="medium-3 columns">
+      {% if handler.user.hasPriv(PRIV.PRIV_USER_PROFILE) %}
         <div class="section side nojs--hide">
           <ol class="menu">
             <a href="javascript:;" class="menu__link edit-mode-hide" name="enter-edit-mode">