social (Content Studio): escape x.platform (stored admin input) + x.id in the draft-card render — closes a stored self-XSS Cody caught one line below the fmtTopic fix (admin-only surface, so low severity, but no raw string should touch innerHTML). renderDrafts is now fully output-encoded

6ea87b32aded02fdc5532de3980c28baf57a2edc · 2026-08-05 18:55:55 -0700 · Steve

Files touched

M public/social.html

Diff

commit 6ea87b32aded02fdc5532de3980c28baf57a2edc
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Aug 5 18:55:55 2026 -0700

    social (Content Studio): escape x.platform (stored admin input) + x.id in the draft-card render — closes a stored self-XSS Cody caught one line below the fmtTopic fix (admin-only surface, so low severity, but no raw string should touch innerHTML). renderDrafts is now fully output-encoded
---
 public/social.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/social.html b/public/social.html
index ecb22982..a65c69f8 100644
--- a/public/social.html
+++ b/public/social.html
@@ -348,7 +348,7 @@
   function renderDrafts(list){
     document.getElementById('drafts').innerHTML = (list||[]).map(function(x){
       var when = new Date(x.created_at).toLocaleString(undefined,{month:'short',day:'numeric',hour:'numeric',minute:'2-digit'});
-      return '<div class="draft"><div class="top"><span class="pf">'+x.platform+'</span>'+(x.topic?'<span>'+fmtTopic(x.topic)+'</span>':'')+'<span>· 🕓 '+when+'</span><button class="del" data-id="'+x.id+'">Delete</button></div><p>'+fmtTopic(x.text)+'</p></div>';
+      return '<div class="draft"><div class="top"><span class="pf">'+esc(x.platform)+'</span>'+(x.topic?'<span>'+fmtTopic(x.topic)+'</span>':'')+'<span>· 🕓 '+when+'</span><button class="del" data-id="'+esc(x.id)+'">Delete</button></div><p>'+fmtTopic(x.text)+'</p></div>';
     }).join('');
     document.querySelectorAll('.del').forEach(function(b){ b.onclick=function(){
       fetch('/api/social/draft/'+b.dataset.id,{method:'DELETE',credentials:'same-origin'}).then(function(){ reload(); });

← 115fabd2 social (Content Studio): fmtTopic now delegates to the full · back to Rentv · auto-save: 2026-08-05T19:14:58 (7 files) — data/deals-regist fd31c4e6 →