From ea7a3c42beecdbe897438ecba5fdab40c23f2d63 Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Sun, 12 Jul 2026 13:08:45 +0800
Subject: [PATCH] fix: escape notification name/url in edit modal to prevent
 HTML injection

---
 public/js/pages/notifications.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/public/js/pages/notifications.js b/public/js/pages/notifications.js
index 564fd3e..faaf6e4 100644
--- a/public/js/pages/notifications.js
+++ b/public/js/pages/notifications.js
@@ -45,8 +45,8 @@ const NotificationsPage = {
 
   showEdit(id,name,type,url,events,active) {
     U.modal('编辑通知', `
-      <form id="ne-form"><div class="form-group"><label>名称</label><input id="ne-name" value="${name}"></div>
-      <div class="form-group"><label>Webhook URL</label><input id="ne-url" value="${url}"></div>
+      <form id="ne-form"><div class="form-group"><label>名称</label><input id="ne-name" value="${U.esc(name).replace(/"/g,'&quot;')}"></div>
+      <div class="form-group"><label>Webhook URL</label><input id="ne-url" value="${U.esc(url).replace(/"/g,'&quot;')}"></div>
       <div class="form-group"><label>触发事件</label>
         <div style="display:flex;flex-wrap:wrap;gap:8px;margin-top:4px">${EventOptions(events)}</div>
         <input type="hidden" id="ne-events" value="${events}">