Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: add escJs for JS string escaping in onclick attributes, apply to users/templates/notifications

Browse Source
This commit is contained in:
canglan
2026-07-12 13:09:52 +08:00
parent da5aa09421
commit 6657c05dec
4 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
public/js/pages/notifications.js
View File

@@ -17,7 +17,7 @@ const NotificationsPage = {
${c.webhook_url?`<div class="detail-row"><span class="lbl">地址</span><span class="val ts" style="word-break:break-all">${U.esc(c.webhook_url)}</span></div>`:''}
<div class="detail-row"><span class="lbl">事件</span><span class="val">${EventsLabel(c.events)}</span></div>
<div class="mt-2 flex g2">
<button class="btn btn-o btn-sm" onclick="NotificationsPage.showEdit(${c.id},'${U.esc(c.name)}','${c.type}','${U.esc(c.webhook_url)}','${c.events}',${c.active})"><i class="fas fa-edit"></i> 编辑</button>
<button class="btn btn-o btn-sm" onclick="NotificationsPage.showEdit(${c.id},'${U.escJs(c.name)}','${c.type}','${U.escJs(c.webhook_url)}','${c.events}',${c.active})"><i class="fas fa-edit"></i> 编辑</button>
<button class="btn btn-i btn-sm" onclick="NotificationsPage.test(${c.id})"><i class="fas fa-paper-plane"></i> 测试</button>
<button class="btn btn-d btn-sm" onclick="NotificationsPage.del(${c.id})"><i class="fas fa-trash"></i> 删除</button>
</div>

2
public/js/pages/templates.js
View File

@@ -15,7 +15,7 @@ const TemplatesPage = {
<div class="card"><div class="card-h"><span>${U.esc(t.name)}</span><code class="ts tm">${t.code}</code></div><div class="card-b">
<div class="detail-row"><span class="lbl">主题</span><span class="val">${U.esc(t.subject)}</span></div>
${t.description ? `<div class="detail-row"><span class="lbl">说明</span><span class="val tm">${U.esc(t.description)}</span></div>` : ''}
<div class="mt-2"><button class="btn btn-p btn-sm" onclick="TemplatesPage.edit('${t.code}', '${U.esc(t.name)}')"><i class="fas fa-edit"></i> 编辑模板</button></div>
<div class="mt-2"><button class="btn btn-p btn-sm" onclick="TemplatesPage.edit('${U.escJs(t.code)}', '${U.escJs(t.name)}')"><i class="fas fa-edit"></i> 编辑模板</button></div>
</div></div>
`).join('');
} catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }

2
public/js/pages/users.js
View File

@@ -21,7 +21,7 @@ const UsersPage = {
<td>${U.badge(u.role,'role')}</td>
<td>${u.active ? '<span class="badge bg-resolved">启用</span>' : '<span class="badge bg-rejected">禁用</span>'}</td>
<td class="ts">${U.date(u.created_at)}</td>
<td><button class="btn btn-o btn-sm" onclick="UsersPage.editUser(${u.id}, '${U.esc(u.username)}', '${U.esc(u.email)}', '${U.esc(u.game_name)}', '${U.esc(u.game_uid)}', '${u.role}', ${u.active})"><i class="fas fa-edit"></i></button></td>
<td><button class="btn btn-o btn-sm" onclick="UsersPage.editUser(${u.id}, '${U.escJs(u.username)}', '${U.escJs(u.email)}', '${U.escJs(u.game_name)}', '${U.escJs(u.game_uid)}', '${u.role}', ${u.active})"><i class="fas fa-edit"></i></button></td>
</tr>`).join('')}</tbody></table></div>
`;
} catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }

5
public/js/utils.js
View File

@@ -25,6 +25,11 @@ const U = {
return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
},
escJs(s) {
if (!s) return '';
return String(s).replace(/\\/g,'\\\\').replace(/'/g,"\\'").replace(/\n/g,'\\n');
},
showAlert(containerId, type, msg) {
const ct = document.getElementById(containerId || 'page-content');
const el = document.createElement('div');