From b8b87e5d505ebea1aa33eb61bfcd2bbf90169d47 Mon Sep 17 00:00:00 2001
From: Peter Goodhall <peter@magicbug.co.uk>
Date: Sun, 5 Apr 2026 17:38:46 +0100
Subject: [PATCH] Escape QSO notice values and include band

Add escapeNoticeValue to sanitize user-provided strings (&, <, >, ", ') to prevent XSS in notice messages. Use a new savedBand variable and update saveMessage assembly to include both callsign and band when available, with fallbacks for when only one is present. Changes are in assets/js/sections/qso.js.
---
 assets/js/sections/qso.js | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/assets/js/sections/qso.js b/assets/js/sections/qso.js
index f26abfd31..c7b9eadb1 100644
--- a/assets/js/sections/qso.js
+++ b/assets/js/sections/qso.js
@@ -10,6 +10,19 @@ function normalizeFieldValue(value) {
 	return String(value ?? "").trim();
 }
 
+function escapeNoticeValue(value) {
+	return String(value || '').replace(/[&<>"']/g, function(char) {
+		var escapes = {
+			'&': '&amp;',
+			'<': '&lt;',
+			'>': '&gt;',
+			'"': '&quot;',
+			"'": '&#39;'
+		};
+		return escapes[char] || char;
+	});
+}
+
 function showQsoNotice(message, alertType) {
 	var safeType = alertType || 'info';
 	var $container = $('#notice-alerts-container');
@@ -605,9 +618,14 @@ var favs={};
 				success: function(response) {
 					if (response && response.status === 'ok') {
 						var savedCallsign = normalizeFieldValue($('#callsign').val()).toUpperCase();
+						var savedBand = normalizeFieldValue($('#band').val());
 						var saveMessage = (response && response.message) ? response.message : 'QSO Added';
-						if (savedCallsign) {
-							saveMessage += ': <strong>' + savedCallsign + '</strong>';
+						if (savedCallsign && savedBand) {
+							saveMessage += ': <strong>' + escapeNoticeValue(savedCallsign) + ' on ' + escapeNoticeValue(savedBand) + '</strong>';
+						} else if (savedCallsign) {
+							saveMessage += ': <strong>' + escapeNoticeValue(savedCallsign) + '</strong>';
+						} else if (savedBand) {
+							saveMessage += ': <strong>on ' + escapeNoticeValue(savedBand) + '</strong>';
 						}
 
 						var qsoFormElement = document.getElementById('qso_input');