diff --git a/static/character-quests-compare.hbs b/static/character-quests-compare.hbs index 3439e47..cec7caa 100644 --- a/static/character-quests-compare.hbs +++ b/static/character-quests-compare.hbs @@ -120,7 +120,9 @@ document.addEventListener('DOMContentLoaded', function() { const [realm, name] = selected.split('/'); // Get the base path by removing everything after /quests/compare/ const basePath = window.location.pathname.split('/quests/compare/')[0]; - window.location.href = `${basePath}/quests/compare/${realm}/${name}`; + const safeRealm = encodeURIComponent(realm); + const safeName = encodeURIComponent(name); + window.location.href = `${basePath}/quests/compare/${safeRealm}/${safeName}`; } }); }); diff --git a/static/character-quests.hbs b/static/character-quests.hbs index 920c6b8..f6a85cf 100644 --- a/static/character-quests.hbs +++ b/static/character-quests.hbs @@ -132,7 +132,9 @@ document.addEventListener('DOMContentLoaded', function() { const selected = compareSelect.value; if (selected) { const [realm, name] = selected.split('/'); - window.location.href = `${window.location.pathname}/compare/${realm}/${name}`; + const sanitizedRealm = encodeURIComponent(realm); + const sanitizedName = encodeURIComponent(name); + window.location.href = `${window.location.pathname}/compare/${sanitizedRealm}/${sanitizedName}`; } }); });