max / makenotwork

server: set wizard upload error text via textContent, not innerHTML Both wizard content uploaders build the error div via createElement + textContent + replaceChildren, so a server error string echoed into the status area can't inject markup.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-05 15:50 UTC

Signed with PGP, not checked

Commit: d7d4254fca401b152d2ff1a9023af4a20768a70d

Parent: 8d6f457

2 files changed, +12 insertions, -2 deletions

M server/static/wizard-item-content-file.js +6 -1

			@@ -66,7 +66,12 @@
66	66		statusEl.innerHTML = '<div class="upload-status-msg">Upload complete.</div>';
67	67		})
68	68		.catch(function(err) {
69		-	statusEl.innerHTML = '<div class="upload-status-msg is-error">' + (err.message \|\| 'Upload failed') + '</div>';
	69	+	// Server error text is set via textContent, not innerHTML, so a
	70	+	// message echoed from an API response can't inject markup.
	71	+	var msg = document.createElement('div');
	72	+	msg.className = 'upload-status-msg is-error';
	73	+	msg.textContent = err.message \|\| 'Upload failed';
	74	+	statusEl.replaceChildren(msg);
70	75		});
71	76		}
72	77		})();

M server/static/wizard-item-content-video.js +6 -1

			@@ -62,7 +62,12 @@
62	62		}
63	63		})
64	64		.catch(function(err) {
65		-	statusEl.innerHTML = '<div class="upload-status-msg is-error">' + (err.message \|\| 'Upload failed') + '</div>';
	65	+	// Server error text is set via textContent, not innerHTML, so a
	66	+	// message echoed from an API response can't inject markup.
	67	+	var msg = document.createElement('div');
	68	+	msg.className = 'upload-status-msg is-error';
	69	+	msg.textContent = err.message \|\| 'Upload failed';
	70	+	statusEl.replaceChildren(msg);
66	71		});
67	72		}
68	73		})();