social (Content Studio): fmtTopic now delegates to the full esc() (& < > ") instead of escaping only '<' — defense-in-depth output-encoding across its 5 innerHTML sites (draft text/topic, featured-video title, calendar). Safe today in text-content, but robust if a string ever moves to an attribute context; also fixes rare &-entity misrender. Removes a redundant weaker escape

115fabd2079b39a55235bb5b8ddb5b985f0391dc · 2026-08-05 18:53:19 -0700 · Steve

Files touched

M public/social.html

Diff

commit 115fabd2079b39a55235bb5b8ddb5b985f0391dc
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Aug 5 18:53:19 2026 -0700

    social (Content Studio): fmtTopic now delegates to the full esc() (& < > ") instead of escaping only '<' — defense-in-depth output-encoding across its 5 innerHTML sites (draft text/topic, featured-video title, calendar). Safe today in text-content, but robust if a string ever moves to an attribute context; also fixes rare &-entity misrender. Removes a redundant weaker escape
---
 public/social.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/social.html b/public/social.html
index 80b590c1..ecb22982 100644
--- a/public/social.html
+++ b/public/social.html
@@ -288,7 +288,7 @@
     ['facebook','Facebook','f'], ['youtube','YouTube','▶'], ['tiktok','TikTok','♪'], ['pinterest','Pinterest','P']
   ];
   var S = {};
-  function fmtTopic(t){ return (t||'').replace(/</g,'&lt;'); }
+  function fmtTopic(t){ return esc(t); } // full output-encoding (& < > "), not just '<' — robust in any innerHTML context; esc() is a hoisted decl defined below
 
   fetch('/api/social',{credentials:'same-origin'}).then(function(r){return r.json();}).then(function(d){
     S = d;

← c014ea30 auto-save: 2026-08-05T18:44:47 (7 files) — data/deals-regist · back to Rentv · social (Content Studio): escape x.platform (stored admin inp 6ea87b32 →