ham-ref/cloudlog
1
0
Fork 0
mirror of https://github.com/magicbug/Cloudlog synced 2026-08-13 17:49:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Escape QSO notice values and include band

Browse source 
Add escapeNoticeValue to sanitize user-provided strings (&, <, >, ", ') to prevent XSS in notice messages. Use a new savedBand variable and update saveMessage assembly to include both callsign and band when available, with fallbacks for when only one is present. Changes are in assets/js/sections/qso.js.
This commit is contained in:
Peter Goodhall 2026-04-05 17:38:46 +01:00
parent 5d7135124d
commit b8b87e5d50
1 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
assets/js/sections/qso.js
View file

@ -10,6 +10,19 @@ function normalizeFieldValue(value) {
return String(value ?? "").trim();
}
function escapeNoticeValue(value) {
return String(value || '').replace(/[&<>"']/g, function(char) {
var escapes = {
'&': '&amp;',
'<': '&lt;',
'>': '&gt;',
'"': '&quot;',
"'": '&#39;'
};
return escapes[char] || char;
});
}
function showQsoNotice(message, alertType) {
var safeType = alertType || 'info';
var $container = $('#notice-alerts-container');
@ -605,9 +618,14 @@ var favs={};
success: function(response) {
if (response && response.status === 'ok') {
var savedCallsign = normalizeFieldValue($('#callsign').val()).toUpperCase();
var savedBand = normalizeFieldValue($('#band').val());
var saveMessage = (response && response.message) ? response.message : 'QSO Added';
if (savedCallsign) {
saveMessage += ': <strong>' + savedCallsign + '</strong>';
if (savedCallsign && savedBand) {
saveMessage += ': <strong>' + escapeNoticeValue(savedCallsign) + ' on ' + escapeNoticeValue(savedBand) + '</strong>';
} else if (savedCallsign) {
saveMessage += ': <strong>' + escapeNoticeValue(savedCallsign) + '</strong>';
} else if (savedBand) {
saveMessage += ': <strong>on ' + escapeNoticeValue(savedBand) + '</strong>';
}
var qsoFormElement = document.getElementById('qso_input');