From 3f0ec8f30b97ab85016a8c671e88036982c6e871 Mon Sep 17 00:00:00 2001
From: serversdown <brian@serversdown.net>
Date: Thu, 14 May 2026 22:42:39 +0000
Subject: [PATCH] fix(locations): Remove/Restore buttons broken by quote
 collision in onclick
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The buttons used inline `onclick="...({{ name | tojson }})"`, which
emits the location name as a JSON-quoted string with double quotes —
those double quotes collide with the onclick attribute's own double
quotes, terminating the attribute early.  Result: the browser parses
the attribute as broken HTML and the click handler never fires.

Switched both Remove and Restore to the data-attribute pattern the
Edit button already uses (data-loc-id / data-loc-name read via
this.dataset in the onclick).  Robust against any character in the
location name.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 templates/partials/projects/location_list.html | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/templates/partials/projects/location_list.html b/templates/partials/projects/location_list.html
index f274373..f9279c2 100644
--- a/templates/partials/projects/location_list.html
+++ b/templates/partials/projects/location_list.html
@@ -53,7 +53,9 @@
                                 class="text-xs px-3 py-1 rounded-full bg-gray-100 text-gray-700 dark:bg-gray-800 dark:text-gray-300">
                             Edit
                         </button>
-                        <button onclick="openRemoveLocationModal('{{ item.location.id }}', {{ item.location.name | tojson }})"
+                        <button data-loc-id="{{ item.location.id }}"
+                                data-loc-name="{{ item.location.name | e }}"
+                                onclick="openRemoveLocationModal(this.dataset.locId, this.dataset.locName)"
                                 class="text-xs px-3 py-1 rounded-full bg-amber-50 text-amber-700 dark:bg-amber-900/20 dark:text-amber-300 hover:bg-amber-100"
                                 title="Mark as no longer actively monitored — preserves historical events">
                             Remove
@@ -122,7 +124,9 @@
                         </div>
 
                         <div class="flex items-center gap-2">
-                            <button onclick="restoreLocation('{{ item.location.id }}', {{ item.location.name | tojson }})"
+                            <button data-loc-id="{{ item.location.id }}"
+                                    data-loc-name="{{ item.location.name | e }}"
+                                    onclick="restoreLocation(this.dataset.locId, this.dataset.locName)"
                                     class="text-xs px-3 py-1 rounded-full bg-green-100 text-green-700 dark:bg-green-900/30 dark:text-green-300 hover:bg-green-200"
                                     title="Restore to active monitoring">
                                 Restore