From 652a4a28a350972d9242abe2862e74e0eb62ab18 Mon Sep 17 00:00:00 2001
From: Andrew <mcdeweykp@gmail.com>
Date: Sun, 27 Feb 2022 14:36:33 -0500
Subject: [PATCH] Santize inputs to the best of our ability. Could not find
 full solutions for server_schedule_edit.hmtl

---
 app/frontend/templates/panel/panel_edit_user.html      | 8 +++++---
 app/frontend/templates/panel/server_backup.html        | 5 +++--
 app/frontend/templates/panel/server_files.html         | 4 ++--
 app/frontend/templates/panel/server_schedule_edit.html | 6 +++---
 4 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/app/frontend/templates/panel/panel_edit_user.html b/app/frontend/templates/panel/panel_edit_user.html
index defd622e..d31405a2 100644
--- a/app/frontend/templates/panel/panel_edit_user.html
+++ b/app/frontend/templates/panel/panel_edit_user.html
@@ -239,13 +239,15 @@
 
 {% block js %}
 <script>
+  const userId = new URLSearchParams(document.location.search).get('id')
+
   $( ".delete-user" ).click(function() {
     var file_to_del = $(this).data("file");
 
-    console.log("User to delete is {{ data['user']['username']  }}");
+    console.log("User to delete is "+userId);
 
     bootbox.confirm({
-        title: "{% raw translate('userConfig', 'deleteUser', data['lang']) %}"+"{{ data['user']['username']  }}",
+        title: "{% raw translate('userConfig', 'deleteUser', data['lang']) %} "+userId,
         message: "{{ translate('userConfig', 'confirmDelete', data['lang']) }}",
         buttons: {
             cancel: {
@@ -259,7 +261,7 @@
         callback: function (result) {
             console.log(result);
             if (result == true) {
-              location.href="/panel/remove_user?id={{ data['user']['user_id'] }}";
+              location.href="/panel/remove_user?id="+userId;
             }
         }
     });
diff --git a/app/frontend/templates/panel/server_backup.html b/app/frontend/templates/panel/server_backup.html
index 482b287c..6507e15f 100644
--- a/app/frontend/templates/panel/server_backup.html
+++ b/app/frontend/templates/panel/server_backup.html
@@ -87,7 +87,7 @@
                                 </a>
                                 <br>
                                 <br>
-                                <button data-file="{{ backup['path'] }}" class="btn btn-danger del_button">
+                                <button data-file="{{ backup['path'] }}" data-backup_path="{{ data['backup_path'] }}" class="btn btn-danger del_button">
                                     <i class="fas fa-trash" aria-hidden="true"></i>
                                     {{ translate('serverBackups', 'delete', data['lang']) }}
                                 </button>
@@ -209,6 +209,7 @@
 
     $( ".del_button" ).click(function() {
       var file_to_del = $(this).data("file");
+      var backup_path = $(this).data('backup_path');
 
       console.log("file to delete is" + file_to_del);
 
@@ -226,7 +227,7 @@
         callback: function (result) {
           console.log(result);
           if (result == true) {
-            var full_path = '{{ data['backup_path'] }}' + '/' + file_to_del;
+            var full_path = backup_path + '/' + file_to_del;
             del_backup(full_path, serverId);
           }
         }
diff --git a/app/frontend/templates/panel/server_files.html b/app/frontend/templates/panel/server_files.html
index bc439193..bff0fa29 100644
--- a/app/frontend/templates/panel/server_files.html
+++ b/app/frontend/templates/panel/server_files.html
@@ -133,7 +133,7 @@
                 </style>
                 <ul class="tree-view">
                   <li>
-                    <div class="tree-ctx-item" data-path="{{ data['server_stats']['server_id']['path'] }}">
+                    <div id="root_dir" class="tree-ctx-item" data-path="{{ data['server_stats']['server_id']['path'] }}">
                       <span id="{{ data['server_stats']['server_id']['path'] }}span" class="files-tree-title tree-caret-down root-dir" data-path="{{ data['server_stats']['server_id']['path'] }}" onclick="getToggleMain(event)">
                         <i class="far fa-folder"></i>
                         <i class="far fa-folder-open"></i>
@@ -650,7 +650,7 @@
   }
   function getTreeView(event) {
 
-    let path = "{{ data['server_stats']['server_id']['path'] }}";
+    const path = $('#root_dir').data('path');;
 
     $.ajax({
       type: "GET",
diff --git a/app/frontend/templates/panel/server_schedule_edit.html b/app/frontend/templates/panel/server_schedule_edit.html
index e12478d6..ae4e54e3 100644
--- a/app/frontend/templates/panel/server_schedule_edit.html
+++ b/app/frontend/templates/panel/server_schedule_edit.html
@@ -233,18 +233,18 @@ function startup(){
   try{
     document.getElementById("{{ data['schedule']['interval_type'] }}").setAttribute('selected', true);
   }catch{
-    console.log("no element named {{ data['schedule']['interval_type'] }}")
+    console.log("no element named")
   }
   try{
   document.getElementById("{{ data['schedule']['difficulty'] }}").setAttribute('selected', true);
 }catch{
-  console.log("no element named {{ data['schedule']['difficulty'] }}")
+  console.log("no element named")
 }
 try{
   document.getElementById("{{ data['schedule']['action'] }}").setAttribute('selected', true);
 
 }catch{
-  console.log("no element named {{ data['schedule']['action'] }}")
+  console.log("no element named")
 }
   ifDays();
   yesnoCheck();