From 17560f0d3428faf588cb8e0921e479faa096e50c Mon Sep 17 00:00:00 2001
From: Josh Patra <joshpatra12@gmail.com>
Date: Tue, 3 Feb 2026 19:46:31 -0500
Subject: [PATCH] Fix Map to Local button by properly escaping JavaScript
 parameters

- Use JSON.stringify instead of escapeHtml for onclick parameters
- Prevents JavaScript syntax errors when track names contain quotes
- Fixes button doing nothing when clicked
---
 allstarr/wwwroot/index.html | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/allstarr/wwwroot/index.html b/allstarr/wwwroot/index.html
index 24f9a90..70c6f14 100644
--- a/allstarr/wwwroot/index.html
+++ b/allstarr/wwwroot/index.html
@@ -1583,7 +1583,12 @@
                     } else if (t.isLocal === false) {
                         statusBadge = '<span class="status-badge warning" style="font-size:0.75rem;padding:2px 8px;margin-left:8px;"><span class="status-dot"></span>External</span>';
                         // Add manual map button for external tracks
-                        mapButton = `<button class="small" onclick="openManualMap('${escapeHtml(name)}', ${t.position}, '${escapeHtml(t.title)}', '${escapeHtml(t.artists[0])}', '${t.spotifyId}')" style="margin-left:8px;font-size:0.75rem;padding:4px 8px;">Map to Local</button>`;
+                        // Use JSON.stringify to properly escape strings for JavaScript
+                        const escapedName = JSON.stringify(name);
+                        const escapedTitle = JSON.stringify(t.title);
+                        const escapedArtist = JSON.stringify(t.artists[0] || '');
+                        const escapedSpotifyId = JSON.stringify(t.spotifyId);
+                        mapButton = `<button class="small" onclick="openManualMap(${escapedName}, ${t.position}, ${escapedTitle}, ${escapedArtist}, ${escapedSpotifyId})" style="margin-left:8px;font-size:0.75rem;padding:4px 8px;">Map to Local</button>`;
                     }
                     
                     return `