fix: add escJs for JS string escaping in onclick attributes, apply to users/templates/notifications

2026-07-12 13:09:52 +08:00
parent da5aa09421
commit 6657c05dec
4 changed files with 8 additions and 3 deletions
--- a/public/js/utils.js
+++ b/public/js/utils.js
@@ -25,6 +25,11 @@ const U = {
    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
  },

+  escJs(s) {
+    if (!s) return '';
+    return String(s).replace(/\\/g,'\\\\').replace(/'/g,"\\'").replace(/\n/g,'\\n');
+  },
+
  showAlert(containerId, type, msg) {
    const ct = document.getElementById(containerId || 'page-content');
    const el = document.createElement('div');