OpenSource/jellyfin-web
1
0 Fork 0
mirror of https://github.com/jellyfin/jellyfin-web.git synced 2026-10-26 16:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Backport pull request #8533 from jellyfin-web/release-12.z

Browse Source 
Fix track titles and external urls not being escaped

Original-merge: 4cffcb7d34

Merged-by: thornbill <thornbill@users.noreply.github.com>

Backported-by: thornbill <thornbill@users.noreply.github.com>
This commit is contained in:
thornbill committed 2026-09-25 10:47:11 -04:00
1 parent f75ba69217
commit f8792e85b6
1 file changed
+15 -5
Download Patch File Download Diff File Expand all files Collapse all files
src/apps/legacy/controllers/itemDetails/index.js
+15 -5
View File
@@ -256,7 +256,7 @@ function renderVideoSelections(page, mediaSources) {
titleParts.push(v.Codec.toUpperCase());
}
return '<option value="' + v.Index + '" ' + selected + '>' + (v.DisplayTitle || titleParts.join(' ')) + '</option>';
return `<option value="${v.Index}" ${selected}>${escapeHtml(v.DisplayTitle || titleParts.join(' '))}</option>`;
}).join('');
select.setAttribute('disabled', 'disabled');
@@ -279,7 +279,7 @@ function renderAudioSelections(page, mediaSources) {
const selectedId = mediaSource.DefaultAudioStreamIndex;
select.innerHTML = tracks.map(function (v) {
const selected = v.Index === selectedId ? ' selected' : '';
return '<option value="' + v.Index + '" ' + selected + '>' + v.DisplayTitle + '</option>';
return `<option value="${v.Index}" ${selected}>${escapeHtml(v.DisplayTitle)}</option>`;
}).join('');
if (tracks.length > 1) {
@@ -309,7 +309,7 @@ function renderSubtitleSelections(page, mediaSources) {
let selected = selectedId === -1 ? ' selected' : '';
select.innerHTML = '<option value="-1">' + globalize.translate('Off') + '</option>' + tracks.map(function (v) {
selected = v.Index === selectedId ? ' selected' : '';
return '<option value="' + v.Index + '" ' + selected + '>' + v.DisplayTitle + '</option>';
return `<option value="${v.Index}" ${selected}>${escapeHtml(v.DisplayTitle)}</option>`;
}).join('');
if (tracks.length > 0) {
@@ -729,12 +729,22 @@ function renderLinks(page, item) {
const links = [];
if (!layoutManager.tv && item.HomePageUrl) {
links.push(`<a is="emby-linkbutton" class="button-link" href="${item.HomePageUrl}" target="_blank">${globalize.translate('ButtonWebsite')}</a>`);
try {
const parsedUrl = new URL(item.HomePageUrl);
links.push(`<a is="emby-linkbutton" class="button-link" href="${parsedUrl.href}" target="_blank">${globalize.translate('ButtonWebsite')}</a>`);
} catch {
console.error('[renderLinks] Failed to parse home page URL', item.HomePageUrl);
}
}
if (item.ExternalUrls) {
for (const url of item.ExternalUrls) {
links.push(`<a is="emby-linkbutton" class="button-link" href="${url.Url}" target="_blank">${escapeHtml(url.Name)}</a>`);
try {
const parsedUrl = new URL(url.Url);
links.push(`<a is="emby-linkbutton" class="button-link" href="${parsedUrl.href}" target="_blank">${escapeHtml(url.Name)}</a>`);
} catch {
console.error('[renderLinks] Failed to parse external URL', url.Url);
}
}
}