From 07763651e8540a40ae94b2ecbb677771b77c64c1 Mon Sep 17 00:00:00 2001
From: Doctor <codimp@exodus-privacy.eu.org>
Date: Sat, 6 Dec 2025 14:13:19 +0100
Subject: [PATCH] template: remove some unsecure dom interpretation

---
 exodus/reports/templates/reports_list.html   | 4 ++--
 exodus/trackers/templates/trackers_list.html | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/exodus/reports/templates/reports_list.html b/exodus/reports/templates/reports_list.html
index ee064006..4e936d71 100644
--- a/exodus/reports/templates/reports_list.html
+++ b/exodus/reports/templates/reports_list.html
@@ -34,8 +34,8 @@ <h4>
         <hr>
         {% if not handle %}
           <select class="custom-select"
-                  onchange="this.options[this.selectedIndex].value && (window.location = '/{{ LANGUAGE_CODE }}/reports/list' + this.options[this.selectedIndex].value);">
-            <option value=" ">{% trans "Latest reports" %}</option>
+                  onchange="const new_value = this.options[this.selectedIndex].value; if (new_value == '?filter=most_trackers') {window.location = '?filter=most_trackers';} else if (new_value == '?filter=no_trackers') {window.location = '?filter=no_trackers';} else {window.location = '?';}">
+            <option value="?">{% trans "Latest reports" %}</option>
             <option value="?filter=most_trackers" {% if filter == 'most_trackers' %}selected{% endif %}>
               {% trans "Sorted by number of trackers" %}</option>
             <option value="?filter=no_trackers" {% if filter == 'no_trackers' %}selected{% endif %}>
diff --git a/exodus/trackers/templates/trackers_list.html b/exodus/trackers/templates/trackers_list.html
index 27a04881..a25cecc9 100644
--- a/exodus/trackers/templates/trackers_list.html
+++ b/exodus/trackers/templates/trackers_list.html
@@ -24,8 +24,8 @@ <h4>
       <div class="col-xl-4 col-lg-5 col-md-8 col-12 mb-2">
         {% trans "Sorted by" %}&nbsp;
         <select class="custom-select"
-                onchange="this.options[this.selectedIndex].value && (window.location = '/{{ LANGUAGE_CODE }}/trackers/' + this.options[this.selectedIndex].value);">
-          <option value=" ">
+                onchange="const new_value = this.options[this.selectedIndex].value; if (new_value == '?filter=apps') {window.location = '?filter=apps';} else {window.location = '?';}">
+          <option value="?">
             {% trans "Alphabetical order" %}
           </option>
           <option value="?filter=apps" {% if filter == 'apps' %}selected{% endif %}>