From d01bbaca54997262acc687503fc31356627d310f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lera=20Elvo=C3=A9?= <yagich@poto.cafe>
Date: Fri, 5 Jun 2026 07:43:43 +0300
Subject: [PATCH] replace `innerHTML +=` with proper appendChild

---
 data/static/js/bits/badge-editor.js       | 6 ++++--
 data/static/js/bits/collections-editor.js | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/data/static/js/bits/badge-editor.js b/data/static/js/bits/badge-editor.js
index 407a31a..6be1547 100644
--- a/data/static/js/bits/badge-editor.js
+++ b/data/static/js/bits/badge-editor.js
@@ -91,8 +91,10 @@ export function badgeEditorToggleFilePicker(ev, sender, el) {
 
 export function badgeEditorAddBadge(ev, sender, el) {
   // TODO: page templates do not get updated on mutation
-  const badge = document.getElementById('badge-template').innerText;
-  el.innerHTML += badge;
+  const badgeTemplate = document.getElementById('badge-template').innerText;
+  const parser = new DOMParser();
+  const e = parser.parseFromString(badgeTemplate, 'text/html').body.firstElementChild;
+  el.appendChild(e);
   b.trigger('badgeEditorAssignImgId');
   badgesCount++;
   b.trigger('setBadgeCount');
diff --git a/data/static/js/bits/collections-editor.js b/data/static/js/bits/collections-editor.js
index ce354cd..956de77 100644
--- a/data/static/js/bits/collections-editor.js
+++ b/data/static/js/bits/collections-editor.js
@@ -1,7 +1,9 @@
 export const b = {}
 
 export function addCollection(ev, sender, el) {
-  el.innerHTML += b.templates.collectionItem;
+  const parser = new DOMParser();
+  const e = parser.parseFromString(b.templates.collectionItem, 'text/html').body.firstElementChild;
+  el.appendChild(e);
 }
 
 export function deleteCollection(ev, sender, el) {