lizhilun/gamer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix security and import validation

Browse Source
This commit is contained in:
lizhilun
2026-07-01 16:13:47 +08:00
parent 6467048f38
commit e69930799c
14 changed files with 498 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/js/autocomplete.js
+6 -4
View File
@@ -4,7 +4,7 @@ const _acCache = {};
async function acFetchNames(field) {
if (_acCache[field] && Date.now() - _acCache[field].ts < 60000) return _acCache[field].data;
try {
const res = await fetch(API + '/api/contacts?field=' + field, { headers: headers() });
const res = await apiFetch(API + '/api/contacts?field=' + field);
if (!res.ok) return [];
const data = await res.json();
_acCache[field] = { data, ts: Date.now() };
@@ -45,14 +45,16 @@ function acSetup(inputId, field) {
if (filtered.length === 0) { list.classList.remove('show'); return; }
activeIdx = -1;
list.innerHTML = filtered.slice(0, 10).map((n, i) => {
let display = n;
let display = escapeHtml(n);
if (q) {
const idx = n.toLowerCase().indexOf(q);
if (idx >= 0) {
display = n.slice(0, idx) + '<span class="ac-highlight">' + n.slice(idx, idx + q.length) + '</span>' + n.slice(idx + q.length);
display = escapeHtml(n.slice(0, idx)) +
'<span class="ac-highlight">' + escapeHtml(n.slice(idx, idx + q.length)) + '</span>' +
escapeHtml(n.slice(idx + q.length));
}
}
return `<div class="ac-item" data-idx="${i}" data-value="${n.replace(/"/g, '&quot;')}">${display}</div>`;
return `<div class="ac-item" data-idx="${i}" data-value="${escapeAttr(n)}">${display}</div>`;
}).join('');
list.classList.add('show');
}