Escape what the monitor page renders, and put the helpers where every page can reach them

The page interpolated media titles, partner hostnames read over the mesh, and docker folder
names straight into innerHTML — its own header claimed otherwise, and the helpers that would
have fixed it were defined in a page it never loads. Container WebUI values now get a scheme
check before they reach window.open().

Plugin/unraid/Varaverk.page

@@ -54,6 +54,50 @@ require_once "$pluginDir/include/config.php";
     return nativeFetch(input, init);
   };
 })();
+
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+// Escaping helpers — shared, because every page builds HTML strings and assigns them to innerHTML.
+//
+// Defined here rather than per page for the reason the CSRF shim is: only one pages/*.php is ever
+// included per request, so a helper defined inside one page does not exist for any other. That is
+// not a hypothetical — these lived in pages/scheduler.php, and pages/monitor.php rendered media
+// titles, partner hostnames and docker folder names straight into innerHTML with no escaping
+// available to it at all.
+//
+// Not in js/varaverk.js, which would otherwise be the obvious home: that file is loaded by a
+// <script src> *below* the tab include, so it is not defined yet while a page's inline script is
+// running. The shared formatters there survive only because every caller is inside a fetch
+// callback. An escaping helper must be callable from the first synchronous line of a page.
+//
+// String() rather than assuming a string: these are fed payload fields that are frequently
+// numbers, and sometimes null or undefined. A helper that throws on a number is a helper call
+// sites will skip.
+//
+// Two functions because the contexts differ, and using the wrong one is silent:
+//   vvEscHtml  text between tags.       Leaves " alone — harmless there.
+//   vvEscAttr  text inside an attribute. Escapes " as well, because a quote inside a
+//              double-quoted attribute ends it early and destroys the rest of the handler.
+// ═══════════════════════════════════════════════════════════════════════════════════════════════
+function vvEscHtml(s) {
+  return String(s ?? '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+}
+function vvEscAttr(s) {
+  return String(s ?? '').replace(/&/g,'&amp;').replace(/"/g,'&quot;')
+                        .replace(/</g,'&lt;').replace(/>/g,'&gt;');
+}
+
+// A URL about to be put in href/src or handed to window.open. Anything that is not plainly http,
+// https or a site-relative path becomes empty — javascript: is the one that matters, and an
+// allowlist is the only way to say that without chasing encodings. include/docs.php applies the
+// same rule to markdown links; container WebUI values, which come from template XML, had no such
+// check before reaching window.open().
+function vvSafeUrl(u) {
+  const s = String(u ?? '').trim();
+  if (s === '') return '';
+  if (/^https?:\/\//i.test(s)) return s;
+  if (/^\/(?!\/)/.test(s))     return s;
+  return '';
+}
 </script>
 
 <?php