Skip to content

Commit b5699a7

Browse files
template: remove some unsecure dom interpretation (#682)
1 parent 1d0cedf commit b5699a7

2 files changed

Lines changed: 4 additions & 4 deletions

File tree

exodus/reports/templates/reports_list.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ <h4>
3434
<hr>
3535
{% if not handle %}
3636
<select class="custom-select"
37-
onchange="this.options[this.selectedIndex].value && (window.location = '/{{ LANGUAGE_CODE }}/reports/list' + this.options[this.selectedIndex].value);">
38-
<option value=" ">{% trans "Latest reports" %}</option>
37+
onchange="const new_value = this.options[this.selectedIndex].value; if (new_value == '?filter=most_trackers') {window.location = '?filter=most_trackers';} else if (new_value == '?filter=no_trackers') {window.location = '?filter=no_trackers';} else {window.location = '?';}">
38+
<option value="?">{% trans "Latest reports" %}</option>
3939
<option value="?filter=most_trackers" {% if filter == 'most_trackers' %}selected{% endif %}>
4040
{% trans "Sorted by number of trackers" %}</option>
4141
<option value="?filter=no_trackers" {% if filter == 'no_trackers' %}selected{% endif %}>

exodus/trackers/templates/trackers_list.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ <h4>
2424
<div class="col-xl-4 col-lg-5 col-md-8 col-12 mb-2">
2525
{% trans "Sorted by" %}&nbsp;
2626
<select class="custom-select"
27-
onchange="this.options[this.selectedIndex].value && (window.location = '/{{ LANGUAGE_CODE }}/trackers/' + this.options[this.selectedIndex].value);">
28-
<option value=" ">
27+
onchange="const new_value = this.options[this.selectedIndex].value; if (new_value == '?filter=apps') {window.location = '?filter=apps';} else {window.location = '?';}">
28+
<option value="?">
2929
{% trans "Alphabetical order" %}
3030
</option>
3131
<option value="?filter=apps" {% if filter == 'apps' %}selected{% endif %}>

0 commit comments

Comments
 (0)