doxa-life + doxa-maps drop-in CDN (public/doxa-maps-cdn) — Forgejo working copy
9860e78ff1
popupHtml() escaped the name, the subtitle, the stats, the description, the photo address and the two button labels, but put prayUrl and profileUrl into href raw. Both end in the people group's slug, which comes from the API, so a slug with a double quote would close the attribute. Both now go through the escapeHtml the popup already uses. Found by the regions plugin, which fixed the same inherited code in its dx-maps port. |
||
|---|---|---|
| .claude/skills | ||
| app | ||
| config | ||
| documentation | ||
| embeddables | ||
| i18n/locales | ||
| migrations | ||
| modules | ||
| public | ||
| server | ||
| .blueprints.json | ||
| .editorconfig | ||
| .env.example | ||
| .gitignore | ||
| .mcp.json | ||
| bun.lock | ||
| DX-MAPS-GALLERY.md | ||
| eslint.config.mjs | ||
| i18n.config.ts | ||
| nuxt.config.ts | ||
| package.json | ||
| tsconfig.json | ||