From e87d2e1218ce0e6d5a9ee89e57976e459b73c7d4 Mon Sep 17 00:00:00 2001
From: Girish Ramakrishnan <girish@cloudron.io>
Date: Sun, 23 Nov 2025 11:17:59 +0100
Subject: [PATCH] Fix issue where footer/name can break templates

stringify the template variables at render time

JSON.stringify - will escape out quotes
<%- renders as-is without any more escaping
---
 dashboard/oidc_error.html             | 13 +++++++------
 dashboard/oidc_interaction_abort.html | 13 +++++++------
 dashboard/oidc_login.html             | 15 ++++++++-------
 dashboard/passwordreset.html          |  9 +++++----
 dashboard/proxyauth.html              | 13 +++++++------
 dashboard/setupaccount.html           |  9 +++++----
 6 files changed, 39 insertions(+), 33 deletions(-)

diff --git a/dashboard/oidc_error.html b/dashboard/oidc_error.html
index 5aca7a0c8..e3aca6106 100644
--- a/dashboard/oidc_error.html
+++ b/dashboard/oidc_error.html
@@ -4,12 +4,13 @@
     <title><%= name %> OpenID Error</title>
 
     <script>
-      window.cloudron = {};
-      window.cloudron.name = '<%= name %>';
-      window.cloudron.iconUrl = '<%- iconUrl %>';
-      window.cloudron.errorMessage = `<%- errorMessage %>`;
-      window.cloudron.footer = `<%- footer -%>`;
-      window.cloudron.language = `<%= language %>`;
+      window.cloudron = <%- JSON.stringify({
+        iconUrl: iconUrl,
+        name: name,
+        errorMessage: errorMessage,
+        footer: footer,
+        language: language
+      }) %>;
     </script>
 
   </head>
diff --git a/dashboard/oidc_interaction_abort.html b/dashboard/oidc_interaction_abort.html
index fe35ff508..1387c82df 100644
--- a/dashboard/oidc_interaction_abort.html
+++ b/dashboard/oidc_interaction_abort.html
@@ -4,12 +4,13 @@
     <title><%= name %> OpenID Access Denied</title>
 
     <script>
-      window.cloudron = {};
-      window.cloudron.name = '<%= name %>';
-      window.cloudron.iconUrl = '<%- iconUrl %>';
-      window.cloudron.submitUrl = '<%- submitUrl %>';
-      window.cloudron.footer = `<%- footer -%>`;
-      window.cloudron.language = `<%= language %>`;
+      window.cloudron = <%- JSON.stringify({
+        iconUrl: iconUrl,
+        name: name,
+        submitUrl: submitUrl,
+        footer: footer,
+        language: language
+      }) %>;
     </script>
 
   </head>
diff --git a/dashboard/oidc_login.html b/dashboard/oidc_login.html
index e87a52548..544b2019d 100644
--- a/dashboard/oidc_login.html
+++ b/dashboard/oidc_login.html
@@ -4,13 +4,14 @@
     <title><%= name %> Login</title>
 
     <script>
-      window.cloudron = {};
-      window.cloudron.name = '<%= name %>';
-      window.cloudron.note = '<%- note %>';
-      window.cloudron.submitUrl = '<%- submitUrl %>';
-      window.cloudron.iconUrl = '<%- iconUrl %>';
-      window.cloudron.footer = `<%- footer -%>`;
-      window.cloudron.language = `<%= language %>`;
+      window.cloudron = <%- JSON.stringify({
+        iconUrl: iconUrl,
+        name: name,
+        note: note,
+        submitUrl: submitUrl,
+        footer: footer,
+        language: language
+      }) %>;
     </script>
 
   </head>
diff --git a/dashboard/passwordreset.html b/dashboard/passwordreset.html
index 19116f2a5..0ee248508 100644
--- a/dashboard/passwordreset.html
+++ b/dashboard/passwordreset.html
@@ -4,10 +4,11 @@
     <title><%= name %> Password Reset</title>
 
     <script>
-      window.cloudron = {};
-      window.cloudron.name = '<%= name %>';
-      window.cloudron.footer = `<%- footer -%>`;
-      window.cloudron.language = `<%= language %>`;
+      window.cloudron = <%- JSON.stringify({
+        name: name,
+        footer: footer,
+        language: language
+      }) %>;
     </script>
 
   </head>
diff --git a/dashboard/proxyauth.html b/dashboard/proxyauth.html
index 8975049fc..4c4322c2a 100644
--- a/dashboard/proxyauth.html
+++ b/dashboard/proxyauth.html
@@ -4,12 +4,13 @@
     <title><%= name %> Login</title>
 
     <script>
-      window.cloudron = {};
-      window.cloudron.name = '<%= name %>';
-      window.cloudron.iconUrl = '<%- iconUrl %>';
-      window.cloudron.loginUrl = '<%- loginUrl %>';
-      window.cloudron.language = `<%= language %>`;
-      window.cloudron.apiOrigin = `<%= apiOrigin %>`;
+      window.cloudron = <%- JSON.stringify({
+        name: name,
+        iconUrl: iconUrl,
+        loginUrl: loginUrl,
+        language: language,
+        apiOrigin: apiOrigin
+      }) %>;
     </script>
 
   </head>
diff --git a/dashboard/setupaccount.html b/dashboard/setupaccount.html
index aa93fd472..311038637 100644
--- a/dashboard/setupaccount.html
+++ b/dashboard/setupaccount.html
@@ -4,10 +4,11 @@
     <title><%= name %> Account Setup</title>
 
     <script>
-      window.cloudron = {};
-      window.cloudron.name = '<%= name %>';
-      window.cloudron.footer = `<%- footer -%>`;
-      window.cloudron.language = `<%= language %>`;
+      window.cloudron = <%- JSON.stringify({
+        name: name,
+        footer: footer,
+        language: language
+      }) %>;
     </script>
 
   </head>