From 79a1ec67dfe8aba3568330230f91ba25c013cdb9 Mon Sep 17 00:00:00 2001
From: MixInSpace <space@punchclub.ru>
Date: Sat, 14 Mar 2026 21:36:27 +0300
Subject: [PATCH] Fix unsafe template rendering in docker views

---
 docker_challenges/assets/view.html                   | 4 ++--
 docker_challenges/templates/admin_docker_status.html | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docker_challenges/assets/view.html b/docker_challenges/assets/view.html
index 2a85cf7..948ef3e 100644
--- a/docker_challenges/assets/view.html
+++ b/docker_challenges/assets/view.html
@@ -1,9 +1,9 @@
 {% extends "challenge.html" %}
 {% block description %}
 {{ challenge.html }}
-<div class='mb-3 text-center' id='docker_container' name='{{ challenge.docker_image | safe }}'>
+<div class='mb-3 text-center' id='docker_container' name='{{ challenge.docker_image | e }}'>
     <span>
-        <a onclick="start_container('{{ challenge.docker_image | safe }}');" class='btn btn-dark'>
+        <a onclick='start_container({{ challenge.docker_image | tojson }});' class='btn btn-dark'>
             <small style='color:white;'><i class="fas fa-play"></i>  Start Docker Instance for challenge</small>
         </a>
     </span>
diff --git a/docker_challenges/templates/admin_docker_status.html b/docker_challenges/templates/admin_docker_status.html
index b43ba19..209cfe6 100644
--- a/docker_challenges/templates/admin_docker_status.html
+++ b/docker_challenges/templates/admin_docker_status.html
@@ -33,9 +33,9 @@ <h1>Docker Status</h1>
                     <tr id='tr_{{docker.instance_id}}' name='{{docker.id}}'>
                         <td class='text-left' value='{{docker.id}}'>{{docker.id}}</td>
                         {% if docker.team_id %}
-                        <td class='text-left' value='{{docker.team_id | safe }}'>{{docker.team_id | safe }}</td>
+                        <td class='text-left' value='{{ docker.team_id | e }}'>{{ docker.team_id | e }}</td>
                         {% else %}
-                        <td class='text-left' value='{{docker.team_id | safe }}'>{{docker.user_id | safe }}</td>
+                        <td class='text-left' value='{{ docker.user_id | e }}'>{{ docker.user_id | e }}</td>
                         {% endif %}
                         <td class='text-left' style="white-space: nowrap;" value='{{docker.docker_image}}'>{{docker.docker_image}}</td>
                         <td class='text-left' style="white-space: nowrap;" value='{{docker.challenge}}'>{{docker.challenge}}</td>
@@ -192,4 +192,4 @@ <h3 class='text-center'> No Docker Containers Active</h3>
     return obj;
 }
 </script>
-{% endblock scripts %}
\ No newline at end of file
+{% endblock scripts %}