doxa-life/doxa-maps-cdn
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Country map popup: the Pray and Full Profile links are escaped like every other value in it

Browse source 
popupHtml() escaped the name, the subtitle, the stats, the description, the photo address and the two
button labels, but put prayUrl and profileUrl into href raw. Both end in the people group's slug,
which comes from the API, so a slug with a double quote would close the attribute. Both now go
through the escapeHtml the popup already uses. Found by the regions plugin, which fixed the same
inherited code in its dx-maps port.
This commit is contained in:
doxa-maps 2026-09-29 05:45:10 +00:00
parent a35daff498
commit 9860e78ff1
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/components/public/CountryMap.vue
View file

@ -154,8 +154,8 @@ function popupHtml(p: any): string {
${rows.length ? `<dl class="cm-popup__stats">${rows.join('')}</dl>` : ''}
${p.description ? `<p class="cm-popup__desc">${escapeHtml(p.description)}</p>` : ''}
<div class="cm-popup__actions">
<a class="cm-popup__btn cm-popup__btn--primary" href="${prayUrl}">${escapeHtml(t('Pray'))}</a>
<a class="cm-popup__btn" href="${profileUrl}">${escapeHtml(t('Full Profile'))}</a>
<a class="cm-popup__btn cm-popup__btn--primary" href="${escapeHtml(prayUrl)}">${escapeHtml(t('Pray'))}</a>
<a class="cm-popup__btn" href="${escapeHtml(profileUrl)}">${escapeHtml(t('Full Profile'))}</a>
</div>
</div>
</div>`