收紧输入渲染与后台配置权限

2026-04-19 14:43:02 +08:00
parent ba6406ed68
commit 438241e878
12 changed files with 550 additions and 48 deletions
@@ -108,6 +108,18 @@

 {{-- ── 手机端抽屉控制脚本 ── --}}
 <script>
+    /**
+     * 对手机端抽屉中的动态文本做 HTML 转义，避免直接拼入 innerHTML。
+     *
+     * @param {string} text
+     * @returns {string}
+     */
+    function escapeMobileDrawerHtml(text) {
+        const div = document.createElement('div');
+        div.textContent = text;
+        return div.innerHTML;
+    }
+
    /**
     * 当前打开的抽屉名称：'toolbar' | 'users' | null
     *
@@ -205,7 +217,7 @@
            const users = Object.keys(onlineUsers);
            container.innerHTML = users.length
                ? users.filter(u => !keyword || u.toLowerCase().includes(keyword))
-                       .map(u => `<div class="user-item" style="padding:5px 8px;font-size:12px;border-bottom:1px solid #eee;">${u}</div>`).join('')
+                       .map(u => `<div class="user-item" style="padding:5px 8px;font-size:12px;border-bottom:1px solid #eee;">${escapeMobileDrawerHtml(u)}</div>`).join('')
                : '<div style="text-align:center;color:#aaa;padding:20px;font-size:12px;">暂无用户</div>';
        }

@@ -232,25 +244,34 @@
                    return;
                }
                const currentRoomId = window.chatContext?.roomId;
-                container.innerHTML = data.rooms.map(room => {
-                    const isCurrent = room.id === currentRoomId;
+                const roomRows = data.rooms.map(room => {
+                    const roomId = Number.parseInt(room.id, 10);
+                    if (!Number.isInteger(roomId)) {
+                        return '';
+                    }
+
+                    const isCurrent = roomId === currentRoomId;
                    const bg        = isCurrent ? '#ecf4ff' : '#fff';
                    const nameColor = isCurrent ? '#336699' : (room.door_open ? '#444' : '#bbb');
-                    const badge     = room.online > 0
-                        ? `<span style="background:#e8f5e9;color:#2e7d32;border-radius:8px;padding:0 6px;font-size:10px;font-weight:bold;">${room.online}人</span>`
+                    const safeRoomName = escapeMobileDrawerHtml(String(room.name ?? ''));
+                    const safeOnlineCount = Math.max(Number.parseInt(room.online, 10) || 0, 0);
+                    const badge     = safeOnlineCount > 0
+                        ? `<span style="background:#e8f5e9;color:#2e7d32;border-radius:8px;padding:0 6px;font-size:10px;font-weight:bold;">${safeOnlineCount}人</span>`
                        : `<span style="background:#f5f5f5;color:#bbb;border-radius:8px;padding:0 6px;font-size:10px;">空</span>`;
                    const currentTag = isCurrent ? `<span style="font-size:9px;color:#7090b0;margin-left:3px;">当前</span>` : '';
-                    const clickAttr  = isCurrent ? '' : `onclick="location.href='/room/${room.id}'"`;
+                    const clickAttr  = isCurrent ? '' : `onclick="location.href='/room/${roomId}'"`;

                    return `<div ${clickAttr}
                        style="display:flex;align-items:center;justify-content:space-between;
                               padding:6px 10px;border-bottom:1px solid #eef2f8;background:${bg};
                               cursor:${isCurrent ? 'default' : 'pointer'};">
                        <span style="color:${nameColor};font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;margin-right:6px;">
-                            ${room.name}${currentTag}
+                            ${safeRoomName}${currentTag}
                        </span>${badge}
                    </div>`;
-                }).join('');
+                }).filter(Boolean).join('');
+
+                container.innerHTML = roomRows || '<div style="text-align:center;color:#bbb;padding:16px;font-size:11px;">暂无房间</div>';
            })
            .catch(() => {
                container.innerHTML = '<div style="text-align:center;color:#f00;padding:10px;font-size:11px;">加载失败</div>';