server: set wizard upload error text via textContent, not innerHTML
Both wizard content uploaders build the error div via createElement + textContent + replaceChildren, so a server error string echoed into the status area can't inject markup.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2 files changed,
+12 insertions,
-2 deletions
| 66 |
66 |
|
statusEl.innerHTML = '<div class="upload-status-msg">Upload complete.</div>';
|
| 67 |
67 |
|
})
|
| 68 |
68 |
|
.catch(function(err) {
|
| 69 |
|
- |
statusEl.innerHTML = '<div class="upload-status-msg is-error">' + (err.message || 'Upload failed') + '</div>';
|
|
69 |
+ |
// Server error text is set via textContent, not innerHTML, so a
|
|
70 |
+ |
// message echoed from an API response can't inject markup.
|
|
71 |
+ |
var msg = document.createElement('div');
|
|
72 |
+ |
msg.className = 'upload-status-msg is-error';
|
|
73 |
+ |
msg.textContent = err.message || 'Upload failed';
|
|
74 |
+ |
statusEl.replaceChildren(msg);
|
| 70 |
75 |
|
});
|
| 71 |
76 |
|
}
|
| 72 |
77 |
|
})();
|
| 62 |
62 |
|
}
|
| 63 |
63 |
|
})
|
| 64 |
64 |
|
.catch(function(err) {
|
| 65 |
|
- |
statusEl.innerHTML = '<div class="upload-status-msg is-error">' + (err.message || 'Upload failed') + '</div>';
|
|
65 |
+ |
// Server error text is set via textContent, not innerHTML, so a
|
|
66 |
+ |
// message echoed from an API response can't inject markup.
|
|
67 |
+ |
var msg = document.createElement('div');
|
|
68 |
+ |
msg.className = 'upload-status-msg is-error';
|
|
69 |
+ |
msg.textContent = err.message || 'Upload failed';
|
|
70 |
+ |
statusEl.replaceChildren(msg);
|
| 66 |
71 |
|
});
|
| 67 |
72 |
|
}
|
| 68 |
73 |
|
})();
|