Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: escape notification name/url in edit modal to prevent HTML injection

Browse Source
This commit is contained in:
canglan
2026-07-12 13:08:45 +08:00
parent 34e821ff1d
commit ea7a3c42be
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
public/js/pages/notifications.js
View File

@@ -45,8 +45,8 @@ const NotificationsPage = {
showEdit(id,name,type,url,events,active) { showEdit(id,name,type,url,events,active) {
U.modal('编辑通知', ` U.modal('编辑通知', `
<form id="ne-form"><div class="form-group"><label>名称</label><input id="ne-name" value="${name}"></div> <form id="ne-form"><div class="form-group"><label>名称</label><input id="ne-name" value="${U.esc(name).replace(/"/g,'&quot;')}"></div>
<div class="form-group"><label>Webhook URL</label><input id="ne-url" value="${url}"></div> <div class="form-group"><label>Webhook URL</label><input id="ne-url" value="${U.esc(url).replace(/"/g,'&quot;')}"></div>
<div class="form-group"><label>触发事件</label> <div class="form-group"><label>触发事件</label>
<div style="display:flex;flex-wrap:wrap;gap:8px;margin-top:4px">${EventOptions(events)}</div> <div style="display:flex;flex-wrap:wrap;gap:8px;margin-top:4px">${EventOptions(events)}</div>
<input type="hidden" id="ne-events" value="${events}"> <input type="hidden" id="ne-events" value="${events}">