From 9860e78ff1d8d6b2ea1365c665fefc653a9102ca Mon Sep 17 00:00:00 2001
From: doxa-maps <maps@doxa.example>
Date: Tue, 29 Sep 2026 05:45:10 +0000
Subject: [PATCH] Country map popup: the Pray and Full Profile links are
 escaped like every other value in it

popupHtml() escaped the name, the subtitle, the stats, the description, the photo address and the two
button labels, but put prayUrl and profileUrl into href raw. Both end in the people group's slug,
which comes from the API, so a slug with a double quote would close the attribute. Both now go
through the escapeHtml the popup already uses. Found by the regions plugin, which fixed the same
inherited code in its dx-maps port.
---
 app/components/public/CountryMap.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/components/public/CountryMap.vue b/app/components/public/CountryMap.vue
index a4672368..d03f235a 100644
--- a/app/components/public/CountryMap.vue
+++ b/app/components/public/CountryMap.vue
@@ -154,8 +154,8 @@ function popupHtml(p: any): string {
         ${rows.length ? `<dl class="cm-popup__stats">${rows.join('')}</dl>` : ''}
         ${p.description ? `<p class="cm-popup__desc">${escapeHtml(p.description)}</p>` : ''}
         <div class="cm-popup__actions">
-          <a class="cm-popup__btn cm-popup__btn--primary" href="${prayUrl}">${escapeHtml(t('Pray'))}</a>
-          <a class="cm-popup__btn" href="${profileUrl}">${escapeHtml(t('Full Profile'))}</a>
+          <a class="cm-popup__btn cm-popup__btn--primary" href="${escapeHtml(prayUrl)}">${escapeHtml(t('Pray'))}</a>
+          <a class="cm-popup__btn" href="${escapeHtml(profileUrl)}">${escapeHtml(t('Full Profile'))}</a>
         </div>
       </div>
     </div>`