V.1.2 - Improved Secrurity, Better Ticket Handling

public/ticketview/ticket-shared.js

@@ -17,7 +17,6 @@ export async function fetchHistory(id) {
 }
 
 export async function logTime(id, timeLog) {
-  // timeLog = { minutes: Number, comment: String, author: String }
   const res = await fetch(`/api/tickets/${id}/time`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -26,7 +25,6 @@ export async function logTime(id, timeLog) {
   return res.json();
 }
 
-// Flexible Update-Funktion für beliebige Felder, z.B. {status, priority, category, actor, ...}
 export async function updateTicket(id, data) {
   const res = await fetch(`/api/tickets/${id}`, {
     method: 'PUT',
@@ -45,15 +43,26 @@ export async function createComment(id, comment) {
   return res.json();
 }
 
+// XSS protection — escape HTML entities before inserting into innerHTML
+export function escapeHtml(str) {
+  if (!str) return '';
+  const div = document.createElement('div');
+  div.textContent = str;
+  return div.innerHTML;
+}
+
+// Convert URLs in text to clickable links (applied AFTER escaping)
+export function linkify(text) {
+  const escaped = escapeHtml(text);
+  const urlPattern = /(\bhttps?:\/\/[^\s<]+)/g;
+  return escaped.replace(urlPattern, '<a href="$1" target="_blank" rel="noopener noreferrer">$1</a>');
+}
+
 export function formatDateTime(date) {
   if (!date) return 'n/a';
-
-  // Convert SQLite DATETIME if needed
   const safeDate = date.includes('T') ? date : date.replace(' ', 'T');
-  const parsed = new Date(safeDate + 'Z'); // Assume UTC
-
+  const parsed = new Date(safeDate + 'Z');
   if (isNaN(parsed.getTime())) return 'n/a';
-
   return parsed.toLocaleString(undefined, {
     year: 'numeric',
     month: 'short',