Fix XSS vulnerabilities in JavaScript files

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-09 13:59:25 +00:00
parent 7a3608b32e
commit 0126dc1cf4
3 changed files with 32 additions and 10 deletions
@@ -184,9 +184,11 @@ function setupWizardEventListeners() {
                const cloudflareToken = document.getElementById('cloudflare-token').value;
                const cloudflareZone = document.getElementById('cloudflare-zone').value;
                
+                // Store only the flag that Cloudflare is enabled
+                // Credentials should be sent directly to backend, never stored client-side
                localStorage.setItem('setup_cloudflare_enabled', 'true');
-                localStorage.setItem('setup_cloudflare_token', cloudflareToken);
-                localStorage.setItem('setup_cloudflare_zone', cloudflareZone);
+                // TODO: Send cloudflareToken and cloudflareZone to backend API instead of localStorage
+                // For now, these credentials are not persisted client-side for security
            }
            
            // Move to step 3