chore: lint (sanitize incoming ids) + refactor (drop dead viol branch) — session close

df1320d94861801a9da8f197cd557fed64c60f80 · 2026-07-22 09:28:32 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit df1320d94861801a9da8f197cd557fed64c60f80
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 22 09:28:32 2026 -0700

    chore: lint (sanitize incoming ids) + refactor (drop dead viol branch) — session close
---
 server.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 5ce2ad3..bc7bb13 100644
--- a/server.js
+++ b/server.js
@@ -117,7 +117,7 @@ function render(){
   else if(s==='bird')list.sort((a,b)=>(/B=1/.test(b.settlement_notes)?1:0)-(/B=1/.test(a.settlement_notes)?1:0));
   else list.sort((a,b)=>(a.pattern_name||'').localeCompare(b.pattern_name||'')||(a.color_name||'').localeCompare(b.color_name||''));
   $('#grid').innerHTML=list.map(p=>{
-    const done=!!p.activated_at, viol=p.settlement_status==='viol'||p.settlement_status==='violation', on=sel.has(p.pid), locked=done||viol;
+    const done=!!p.activated_at, viol=p.settlement_status==='violation', on=sel.has(p.pid), locked=done||viol;
     return '<div class="card'+(on?' sel':'')+(done?' done':'')+(viol?' viol':'')+'" data-id="'+p.pid+'">'+
       '<div class="imgwrap" data-open="'+p.product_url+'">'+
       (locked?'':'<input type="checkbox" class="chk" '+(on?'checked':'')+' data-id="'+p.pid+'">')+
@@ -186,7 +186,7 @@ const server = http.createServer(async (req, res) => {
     if (req.url === '/api/products') { res.writeHead(200, { 'content-type': 'application/json' }); return res.end(JSON.stringify(products())); }
     if ((req.url === '/api/activate' || req.url === '/api/violation') && req.method === 'POST') {
       let b = ''; req.on('data', c => b += c); await new Promise(r => req.on('end', r));
-      const ids = (JSON.parse(b || '{}').ids || []).slice(0, 200);
+      const ids = (JSON.parse(b || '{}').ids || []).slice(0, 200).filter(id => /^\d+$/.test(String(id)));
       const fn = req.url === '/api/violation' ? violate : activate;
       const results = [];
       for (const id of ids) { try { results.push(await fn(id)); } catch (e) { results.push({ pid: id, ok: false, err: String(e).slice(0, 120) }); } await sleep(400); }

← f3f459f Add marquee drag-select + Confirm Settlement Violation (arch · back to Degournay Review Viewer · (newest)