From 88c34e2b7e03dd6e49ae402fa4387ca363c07370 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dalibor=20Markovi=C4=87?= <dalibor31@gmail.com>
Date: Sat, 20 Jun 2026 14:12:13 +0200
Subject: [PATCH] =?UTF-8?q?Bezbednost:=20ntechToast=20koristi=20textConten?=
 =?UTF-8?q?t=20za=20tekst=20poruke=20(XSS=20za=C5=A1tita)=20CodeQL=20js/xs?=
 =?UTF-8?q?s-through-dom=20=E2=80=94=20flash=20poruku=20server=20HTML-esca?=
 =?UTF-8?q?pe-uje,=20ali=20textContent=20je=20dekodira,=20pa=20bi=20innerH?=
 =?UTF-8?q?TML=20ponovo=20interpretirao=20sadr=C5=BEaj=20kao=20HTML.=20Sad?=
 =?UTF-8?q?a=20tekst=20ide=20kroz=20textContent,=20a=20samo=20stati=C4=8Dk?=
 =?UTF-8?q?i=20SVG=20kroz=20innerHTML.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/templates/teme/podrazumevana/base.html | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/web/templates/teme/podrazumevana/base.html b/web/templates/teme/podrazumevana/base.html
index 763b678..b93cb9c 100644
--- a/web/templates/teme/podrazumevana/base.html
+++ b/web/templates/teme/podrazumevana/base.html
@@ -289,7 +289,12 @@
         var svg = tip === 'greska'
             ? '<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>'
             : '<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" viewBox="0 0 24 24"><polyline points="20 6 9 17 4 12"/></svg>';
-        t.innerHTML = svg + '<span>' + tekst + '</span>';
+        // SVG je statički literal (bezbedan za innerHTML); korisnički tekst ide
+        // preko textContent da se ne reinterpretira kao HTML (XSS zaštita)
+        t.innerHTML = svg;
+        var tekstSpan = document.createElement('span');
+        tekstSpan.textContent = tekst;
+        t.appendChild(tekstSpan);
         // prilagođavamo poziciju za mobilne uređaje
         t.style.bottom = '24px';
         t.style.right = '16px';