diff --git a/packages/ui-default/backendlib/markdown-it-xss.js b/packages/ui-default/backendlib/markdown-it-xss.js
index bc7664335..f554dd797 100644
--- a/packages/ui-default/backendlib/markdown-it-xss.js
+++ b/packages/ui-default/backendlib/markdown-it-xss.js
@@ -24,13 +24,13 @@ const xss = new Xss.FilterXSS({
     dd: [],
     del: ['datetime'],
     details: ['open'],
-    div: ['id','class'],
+    div: ['id', 'class'],
     dl: [],
     dt: [],
     em: [],
     font: ['color', 'size', 'face'],
     h1: ['id'],
-    h2: ['id','class'],
+    h2: ['id', 'class'],
     h3: ['id'],
     h4: ['id'],
     h5: ['id'],
@@ -66,8 +66,11 @@ const xss = new Xss.FilterXSS({
     var: [],
     video: ['autoplay', 'controls', 'loop', 'preload', 'src', 'height', 'width'],
   },
+  allowCommentTag: false,
+  stripIgnoreTagBody: ['script'],
   safeAttrValue(tag, name, value) {
     if (name === 'id') return `xss-id-${value}`;
+    if (name === 'class') return value.replace(/badge/g, 'xss-badge');
     return value;
   },
 });
diff --git a/packages/ui-default/components/discussion/comments.page.styl b/packages/ui-default/components/discussion/comments.page.styl
index 44a3eb5e1..a4881cda6 100644
--- a/packages/ui-default/components/discussion/comments.page.styl
+++ b/packages/ui-default/components/discussion/comments.page.styl
@@ -64,9 +64,6 @@ $downvote-color = red
     // FIXME doesn't work on IE 11
     display: flex
 
-    >.media__body
-      width: calc(100% - (50px + 0.625rem))
-
   &:last-child
     >.media
       padding-bottom: 0
diff --git a/packages/ui-default/components/discussion/comments.page.tsx b/packages/ui-default/components/discussion/comments.page.tsx
index a8bdef39c..0358442e6 100644
--- a/packages/ui-default/components/discussion/comments.page.tsx
+++ b/packages/ui-default/components/discussion/comments.page.tsx
@@ -111,6 +111,7 @@ async function onCommentClickReplyComment(ev, options: any = {}) {
 }
 
 async function onCommentClickReplyReply(ev) {
+  console.log(ev);
   const $evTarget = $(ev.currentTarget);
   const $mediaBody = $evTarget.closest('.media__body');
   const uid = $mediaBody
@@ -119,7 +120,7 @@ async function onCommentClickReplyReply(ev) {
 
   $evTarget
     .closest('.dczcomments__item')
-    .find('[name="dczcomments__op-reply-comment"]').eq(0)
+    .find('[data-op="reply"][data-type="comment"]').eq(0)
     .trigger('click', { initialText: `@[](/user/${uid.trim()}) ` });
 }
 
diff --git a/packages/ui-default/package.json b/packages/ui-default/package.json
index 08ce2ff58..29b64d53e 100644
--- a/packages/ui-default/package.json
+++ b/packages/ui-default/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.31.7",
+  "version": "4.31.8",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",
diff --git a/packages/ui-default/templates/components/comments_solution.html b/packages/ui-default/templates/components/comments_solution.html
index 8d43b099d..eace1c6f6 100644
--- a/packages/ui-default/templates/components/comments_solution.html
+++ b/packages/ui-default/templates/components/comments_solution.html
@@ -109,22 +109,21 @@
     <div class="media__body top">
       <div class="clearfix">
         <div class="supplementary dczcomments__supplementary">
-          {{ user.render_inline(udoc) }}
-          @ {{ datetimeSpan(doc._id)|safe }}
+          {{ user.render_inline(udoc) }} @ {{ datetimeSpan(doc._id)|safe }}
         </div>
         <div class="dczcomments__operations nojs--hide">
         {% if handler.user.hasPerm(reply_post_perm) %}
-          <a href="javascript:;" data-tooltip="{{ _('Reply') }}" name="dczcomments__op-reply-comment" 
+          <a href="javascript:;" data-tooltip="{{ _('Reply') }}" data-op="reply" data-type="comment" 
             data-form="{{ {operation: reply_post_op, psid: doc._id}|json }}"
           ><span class="icon icon-reply"></span></a>
         {% endif %}
         {% if (handler.user.hasPerm(comment_edit_self_perm) and handler.user.own(doc)) or handler.user.hasPerm(comment_edit_perm) %}
-          <a href="javascript:;" data-tooltip="{{ _('Edit') }}" name="dczcomments__op-edit-comment"
+          <a href="javascript:;" data-tooltip="{{ _('Edit') }}" data-op="edit" data-type="comment"
             data-form="{{ {operation: comment_edit_op, psid: doc._id}|json }}"
           ><span class="icon icon-edit"></span></a>
         {% endif %}
         {% if (handler.user.hasPerm(comment_delete_self_perm) and handler.user.own(doc)) or handler.user.hasPerm(comment_delete_perm) %}
-          <a href="javascript:;" data-tooltip="{{ _('Delete') }}" name="dczcomments__op-delete-comment"
+          <a href="javascript:;" data-tooltip="{{ _('Delete') }}" data-op="delete" data-type="comment"
             data-form="{{ {operation: comment_delete_op, psid: doc._id}|json }}"
           ><span class="icon icon-delete"></span></a>
         {% endif %}
@@ -146,15 +145,15 @@
                 </div>
                 <div class="dczcomments__operations nojs--hide">
                 {% if handler.user.hasPerm(reply_post_perm) %}
-                  <a href="javascript:;" data-tooltip="{{ _('Reply') }}" name="dczcomments__op-reply-reply"><span class="icon icon-reply"></span></a>
+                  <a href="javascript:;" data-tooltip="{{ _('Reply') }}" data-op="reply" data-type="reply"><span class="icon icon-reply"></span></a>
                 {% endif %}
                 {% if (handler.user.hasPerm(reply_edit_self_perm) and handler.user.own(doc)) or handler.user.hasPerm(reply_edit_perm) %}
-                  <a href="javascript:;" data-tooltip="{{ _('Edit') }}" name="dczcomments__op-edit-reply"
+                  <a href="javascript:;" data-tooltip="{{ _('Edit') }}" data-op="edit" data-type="reply"
                     data-form="{{ {operation: reply_edit_op, psid: doc._id, psrid: rdoc._id}|json }}"
                   ><span class="icon icon-edit"></span></a>
                 {% endif %}
                 {% if (handler.user.hasPerm(reply_delete_self_perm) and handler.user.own(doc)) or handler.user.hasPerm(reply_delete_perm) %}
-                  <a href="javascript:;" data-tooltip="{{ _('Delete') }}" name="dczcomments__op-delete-reply"
+                  <a href="javascript:;" data-tooltip="{{ _('Delete') }}" data-op="delete" data-type="reply"
                     data-form="{{ {operation: reply_delete_op, psid: doc._id, psrid: rdoc._id}|json }}"
                   ><span class="icon icon-delete"></span></a>
                 {% endif %}