From 502bc2f530df84311dcc57e214b8337d45e25d53 Mon Sep 17 00:00:00 2001
From: Richard Koliser <richard.koliser@kasmweb.com>
Date: Fri, 23 May 2025 13:26:58 -0400
Subject: [PATCH] Add escaping for the JQuery selector on image friendly name

---
 public/js/index.js | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/public/js/index.js b/public/js/index.js
index a4f3d59..38635f7 100644
--- a/public/js/index.js
+++ b/public/js/index.js
@@ -334,15 +334,16 @@ async function pickImages(upgrade) {
 // Select an individual image
 function selectImage(image) {
   let imageKey = image.replace(new RegExp('_', 'g'), ' ').replace('-', '.');
+  let safeSelectorId = $.escapeSelector(image); // Escape the ID for jQuery
   if (installImages.includes(imageKey)) {
     installImages = installImages.filter(e => e !== imageKey)
-    $('#' + image).css({
+    $('#' + safeSelectorId).css({
       filter: 'grayscale(100%)',
       background: ''
     });
   } else {
     installImages.push(imageKey);
-    $('#' + image).css({
+    $('#' + safeSelectorId).css({
       filter: '',
       background: '#89cff0'
     });
@@ -356,7 +357,8 @@ function selectAll() {
     selected = false;
     for (let image of images.images) {
       let imageElem = image.friendly_name.replace(new RegExp(' ', 'g'), '_').replace('.', '-');
-      $('#' + imageElem).css({
+      let safeSelectorId = $.escapeSelector(imageElem); // Escape the ID for jQuery
+      $('#' + safeSelectorId).css({
         filter: 'grayscale(100%)',
         background: ''
       });
@@ -365,8 +367,9 @@ function selectAll() {
     selected = true;
     for (let image of images.images) {
       let imageElem = image.friendly_name.replace(new RegExp(' ', 'g'), '_').replace('.', '-');
+      let safeSelectorId = $.escapeSelector(imageElem); // Escape the ID for jQuery
       installImages.push(image.friendly_name);
-      $('#' + imageElem).css({
+      $('#' + safeSelectorId).css({
         filter: '',
         background: '#89cff0'
       });