FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sweep every onclick built from data: an unescaped quote silently killed nine handlers

Browse Source
This commit is contained in:
Gmer4Lfe
2026-08-06 22:13:10 -04:00
parent d135dff5cd
commit d5944c2443
2 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/unraid/pages/scheduler.php
+9 -9
View File
@@ -1985,21 +1985,21 @@ function _vvImpRender(d) {
if (d.parent !== null) {
const pname = d.parent === '/' ? '/' : (d.parent.replace(/^.*\//, '') || d.parent) + '/';
html += `<div class="vv-imp-row" onclick="_vvImpBrowse(${JSON.stringify(d.parent)})"
html += `<div class="vv-imp-row" onclick="_vvImpBrowse(${vvEscAttr(JSON.stringify(d.parent))})"
style="padding:5px 12px;font-size:11px;color:#444;font-style:italic;cursor:pointer;font-family:monospace;">&#8593; ${pname}</div>`;
}
for (const dir of d.dirs) {
const name = dir.replace(/^.*\//, '') || dir;
html += `<div class="vv-imp-row" onclick="_vvImpBrowse(${JSON.stringify(dir)})" title="${_vvImpEsc(dir)}"
html += `<div class="vv-imp-row" onclick="_vvImpBrowse(${vvEscAttr(JSON.stringify(dir))})" title="${vvEscAttr(dir)}"
style="padding:5px 12px;font-size:11px;color:#666;cursor:pointer;font-family:monospace;">&#9654; ${_vvImpEsc(name)}</div>`;
}
for (const file of d.files) {
const name = file.replace(/^.*\//, '') || file;
const sel = file === _vvImpSelected;
html += `<div class="vv-imp-row vv-imp-file${sel ? ' vv-imp-file-sel' : ''}" data-path="${_vvImpEsc(file)}"
onclick="_vvImpSelectFile(${JSON.stringify(file)})" title="${_vvImpEsc(file)}"
html += `<div class="vv-imp-row vv-imp-file${sel ? ' vv-imp-file-sel' : ''}" data-path="${vvEscAttr(file)}"
onclick="_vvImpSelectFile(${vvEscAttr(JSON.stringify(file))})" title="${vvEscAttr(file)}"
style="padding:5px 12px;font-size:11px;cursor:pointer;font-family:monospace;
color:${sel ? '#4caf50' : '#4a9eff'};background:${sel ? '#0f1f0f' : 'transparent'};">&#128196; ${_vvImpEsc(name)}</div>`;
}
@@ -2677,8 +2677,8 @@ function vvUpdateLocks(locks) {
html += '<div class="vv-lock-row">'
+ '<span class="vv-lk-name">' + vvEscHtml(lk.name) + '</span>'
+ '<span class="vv-lk-age">' + vvFmtAge(lk.age) + '</span>'
+ '<button class="vv-btn-sm vv-lock-clear" onclick="vvClearLock(\''
+ vvEscHtml(lk.file) + '\',this)">Clear</button>'
+ '<button class="vv-btn-sm vv-lock-clear" onclick="vvClearLock('
+ vvEscAttr(JSON.stringify(lk.file)) + ',this)">Clear</button>'
+ '</div>';
}
body.innerHTML = html + '</div>';
@@ -2811,7 +2811,7 @@ function vvUpdateErrors(errors) {
+ ' onclick="vvErrOpenAtLine(' + scriptJs + ',' + e.ts + ',' + lineJs + ',this)">'
+ vvEscHtml(label) + '</span>'
+ '<span class="vv-err-age">' + vvFmtAge(now - e.ts) + '</span>'
+ '<button class="vv-btn-sm vv-ack-btn" onclick="vvAckError(\'' + e.script.replace(/\\/g,"\\\\").replace(/'/g,"\\'") + "'," + e.ts + ',this)">Ack</button>'
+ '<button class="vv-btn-sm vv-ack-btn" onclick="vvAckError(' + scriptJs + ',' + e.ts + ',this)">Ack</button>'
+ '</div>'
+ '<div class="vv-err-line vv-err-line-open"'
+ ' title="Open the log at this line — also acknowledges it"'
@@ -3173,10 +3173,10 @@ function vvLoadRecentActivity() {
? '<button class="vv-activity-ask' + (bad ? ' vv-ask-bad' : '') + '"'
+ ' title="' + (bad ? 'Ask the assistant why this run failed'
: 'Ask the assistant how this run went') + '"'
+ ' onclick="vvAiAskRun(' + JSON.stringify(r.id) + ',' + bad + ',event)">'
+ ' onclick="vvAiAskRun(' + vvEscAttr(JSON.stringify(r.id)) + ',' + bad + ',event)">'
+ (bad ? 'why?' : 'recap') + '</button>'
: '';
html += '<div class="vv-activity-row" onclick="vvOpenRight(' + JSON.stringify(r.id) + ')">'
html += '<div class="vv-activity-row" onclick="vvOpenRight(' + vvEscAttr(JSON.stringify(r.id)) + ')">'
+ '<span class="vv-activity-dot ' + cls + '">●</span>'
+ '<span class="vv-activity-label">' + vvEscHtml(r.label) + '</span>'
+ '<span class="vv-activity-ago">' + vvTimeAgo(now - r.start) + '</span>'