safe destroy: htmlEncode confirmation message

to avoid interpreting HTML.

Signed-off-by: Friedrich Weber <f.weber@proxmox.com>
This commit is contained in:
Friedrich Weber 2025-03-31 11:20:22 +02:00 committed by Thomas Lamprecht
parent 86b2264d8b
commit 2611d905de

View File

@ -189,13 +189,13 @@ Ext.define('Proxmox.window.SafeDestroy', {
let taskName = me.getTaskName();
if (Ext.isDefined(taskName)) {
me.lookupReference('messageCmp').setHtml(
Proxmox.Utils.format_task_description(taskName, itemId),
Ext.htmlEncode(Proxmox.Utils.format_task_description(taskName, itemId)),
);
} else {
throw "no task name specified";
}
me.lookupReference('confirmField')
.setFieldLabel(`${gettext('Please enter the ID to confirm')} (${itemId})`);
let label = `${gettext('Please enter the ID to confirm')} (${itemId})`;
me.lookupReference('confirmField').setFieldLabel(Ext.htmlEncode(label));
},
});