From 45ea7ccaa413c6ae3fb992a5e92e08f2fc88f6fd Mon Sep 17 00:00:00 2001
From: Arnaud Delcasse <arnaud.delcasse@mobicoop.org>
Date: Wed, 8 Oct 2025 23:37:24 +0200
Subject: [PATCH] escape json

---
 .../_partials/bookings_list.html                   | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/web/layouts/solidarity_transport/_partials/bookings_list.html b/web/layouts/solidarity_transport/_partials/bookings_list.html
index f595f9e..18ccec6 100644
--- a/web/layouts/solidarity_transport/_partials/bookings_list.html
+++ b/web/layouts/solidarity_transport/_partials/bookings_list.html
@@ -10,16 +10,16 @@
     {{range $index, $booking := .ViewState.bookings}}{{if $index}},{{end}}{
       id: '{{$booking.Id}}',
       driverId: '{{$booking.DriverId}}',
-      driverFirstName: '{{ (index $.ViewState.drivers_map $booking.DriverId).Data.first_name }}',
-      driverLastName: '{{ (index $.ViewState.drivers_map $booking.DriverId).Data.last_name }}',
+      driverFirstName: {{ jsEscape (index $.ViewState.drivers_map $booking.DriverId).Data.first_name }},
+      driverLastName: {{ jsEscape (index $.ViewState.drivers_map $booking.DriverId).Data.last_name }},
       passengerId: '{{$booking.PassengerId}}',
-      passengerFirstName: '{{ (index $.ViewState.passengers_map $booking.PassengerId).Data.first_name }}',
-      passengerLastName: '{{ (index $.ViewState.passengers_map $booking.PassengerId).Data.last_name }}',
-      pickupLabel: '{{$booking.Journey.PassengerPickup.Properties.label}}',
-      dropLabel: '{{$booking.Journey.PassengerDrop.Properties.label}}',
+      passengerFirstName: {{ jsEscape (index $.ViewState.passengers_map $booking.PassengerId).Data.first_name }},
+      passengerLastName: {{ jsEscape (index $.ViewState.passengers_map $booking.PassengerId).Data.last_name }},
+      pickupLabel: {{ jsEscape $booking.Journey.PassengerPickup.Properties.label }},
+      dropLabel: {{ jsEscape $booking.Journey.PassengerDrop.Properties.label }},
       pickupDate: '{{ timeFormat $booking.Journey.PassengerPickupDate "02/01/2006 15:04" }}',
       status: '{{$booking.Status}}',
-      motivation: '{{if $booking.Data.motivation}}{{$booking.Data.motivation}}{{end}}'
+      motivation: {{ if $booking.Data.motivation }}{{ jsEscape $booking.Data.motivation }}{{ else }}''{{ end }}
     }{{end}}
   ],
   currentPage: 1,