Changeset 3751971 for mxchat-basic/trunk/js/admin-testing-tab.js

Timestamp:

10/17/2026 01:47:11 PM (12 days ago)

Author:

mxchat

Message:

Release 3.2.26 - security hardening, new models (GPT-6.1 Sol, Claude 5.5 family, Grok 4.7, Gemini 4 Argon, DeepSeek Flash), automatic moves off discontinued models, token usage in Transcripts, page-builder and ACF Blocks imports

File:

• mxchat-basic/trunk/js/admin-testing-tab.js (modified) (7 diffs)

mxchat-basic/trunk/js/admin-testing-tab.js

@@ -7 +7 @@
 (function($) {
     'use strict';
+
+    // Knowledge-base titles and URLs (imported pages, sitemaps, files), action
+    // labels and the URL guard's results are stored text: escape everything put
+    // into the panel as HTML. Same quote-safe helper as mxchat_transcripts.js.
+    function escapeHtml(text) {
+        if (!text && text !== 0) return '';
+        return String(text)
+            .replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#039;');
+    }
 
     var AdminTestingPanel = {
@@ -270 +283 @@
                 } catch (e) {}
 
+                var link = /^https?:\/\//i.test(String(url))
+                    ? '<a href="' + escapeHtml(url) + '" target="_blank" rel="noopener noreferrer" class="url-link" title="' + escapeHtml(url) + '">' + escapeHtml(displayUrl) + '</a>'
+                    : '<span class="url-link">' + escapeHtml(displayUrl) + '</span>';
                 html += '<div class="url-card"><div class="url-line">' +
-                    '<span class="url-icon">&#128279;</span>' +
-                    '<a href="' + url + '" target="_blank" rel="noopener noreferrer" class="url-link" title="' + url + '">' + displayUrl + '</a>' +
+                    '<span class="url-icon">&#128279;</span>' + link +
                     '</div></div>';
             });
@@ -309 +324 @@
                     '<div class="action-line">' +
                         '<span class="action-icon">' + statusIcon + '</span>' +
-                        '<span class="action-name">' + action.intent_label + '</span>' +
+                        '<span class="action-name">' + escapeHtml(action.intent_label) + '</span>' +
                         '<span class="action-score">' + action.similarity_percentage + '%</span>' +
                     '</div>' +
@@ -429 +444 @@
                     '<div class="match-source">' +
                         (group.isUrl ?
-                            '<span class="source-icon link-icon">&#128279;</span> ' + group.url :
-                            '<span class="source-icon doc-icon">&#128196;</span> ' + group.url
+                            '<span class="source-icon link-icon">&#128279;</span> ' + escapeHtml(group.url) :
+                            '<span class="source-icon doc-icon">&#128196;</span> ' + escapeHtml(group.url)
                         ) +
                     '</div>' +
@@ -486 +501 @@
             }).done(function(data) {
                 if (data.success) {
-                    $('#mxch-testing-threshold').html('<code>' + data.data.threshold_percentage + '</code>');
+                    $('#mxch-testing-threshold').html('<code>' + escapeHtml(data.data.threshold_percentage) + '</code>');
                 } else {
                     $('#mxch-testing-threshold').html('<span class="error-text">Error loading threshold</span>');
@@ -536 +551 @@
                 if (data.success) {
                     var kbData = data.data;
-                    el.html('<span class="success-text">&#10003; ' + kbData.status + '</span> (' + kbData.type + ' - ' + kbData.documents + ')');
+                    el.html('<span class="success-text">&#10003; ' + escapeHtml(kbData.status) + '</span> (' + escapeHtml(kbData.type) + ' - ' + escapeHtml(kbData.documents) + ')');
                 } else {
                     el.html('<span class="error-text">Error loading KB status</span>');
@@ -641 +656 @@
             var entry = document.createElement('div');
             entry.className = 'mxch-testing-debug-entry';
-            entry.innerHTML = '<span class="mxch-testing-debug-timestamp">[' + timestamp + ']</span> ' + message;
+            entry.innerHTML = '<span class="mxch-testing-debug-timestamp">[' + escapeHtml(timestamp) + ']</span> ' + escapeHtml(message);
             consoleEl.appendChild(entry);
             consoleEl.scrollTop = consoleEl.scrollHeight;