fix: escape issue + improvement

PrestaShop · Jun 12, 2024 · ff7ea90 · ff7ea90
1 parent 88aca6c
commit ff7ea90
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 10 deletions.
diff --git a/src/js/components/UseHandleCartAction.ts b/src/js/components/UseHandleCartAction.ts
@@ -50,17 +50,27 @@ const sendCartRefreshRequest = (target: HTMLElement): void => {
 
         if (alertPlaceholder && productUrl && productName) {
           const alertText = alertPlaceholder.getAttribute('data-alert');
-          const productLink = `<a class="alert-link" href="${productUrl}">${productName}</a>`;
-          const alertMessage = `${productLink} ${alertText}`;
 
-          if (alertMessage) {
-            const alert = useAlert(alertMessage, {
-              type: 'success',
-              selector: SelectorsMap.cart.alertPlaceholder,
-            });
+          // Create the product link element
+          const productLink = document.createElement('a');
+          productLink.classList.add('alert-link');
+          productLink.setAttribute('href', productUrl);
+          productLink.textContent = productName;
 
-            alert.show();
-          }
+          // Create the alert message container
+          const alertMessage = document.createElement('span');
+          alertMessage.appendChild(productLink);
+          alertMessage.append(` ${alertText}`);
+
+          const alertMessageContainer = document.createElement('div');
+          alertMessageContainer.appendChild(alertMessage);
+
+          const alert = useAlert(alertMessageContainer.innerHTML, {
+            type: 'success',
+            selector: SelectorsMap.cart.alertPlaceholder,
+          });
+
+          alert.show();
         }
       }
     })

diff --git a/templates/checkout/_partials/cart-detailed-product-line.tpl b/templates/checkout/_partials/cart-detailed-product-line.tpl
@@ -177,7 +177,7 @@
         data-id-product-attribute="{$product.id_product_attribute|escape:'javascript'}"
         data-id-customization="{$product.id_customization|escape:'javascript'}"
         data-product-url="{$product.url|escape:'javascript'}"
-        data-product-name="{$product.name|escape:'javascript'}"
+        data-product-name="{$product.name|escape:'htmlall':'UTF-8'}"
         >
         {l s='Remove' d='Shop.Theme.Checkout'}
       </a>