Don't use innerHTML to avoid escaping issues, and add tooltips to the new links describing their purpose

1 files changed, 21 insertions, 7 deletions

diff --git a/data/js/bug-page-mod.js b/data/js/bug-page-mod.js
index 2a8c817..2213dfb 100644
--- a/data/js/bug-page-mod.js
+++ b/data/js/bug-page-mod.js
@@ -1161,21 +1161,35 @@ function addNewLinks(d) {
 
     if (product) {
         var label = d.getElementById('field_container_product');
-        var span = d.createElement('span');
         var url = 'enter_bug.cgi?product=' + encodeURIComponent(product.value);
         span.innerHTML = "(<a href='" + url + "'>new</a>)";
-        if (label && span) {
-            label.appendChild(span);
+        if (label) {
+          label.appendChild(d.createTextNode("("));
+          var link = d.createElement('a');
+          link.href = url;
+          link.textContent = "new";
+          link.title = "File a new bug in the same Product";
+          var span = d.createElement('span');
+          span.appendChild(link);
+          label.appendChild(span);
+          label.appendChild(d.createTextNode(")"));
         }
     }
 
     if (product && component) {
         var select = d.querySelector("select#component");
-        var span = d.createElement('span');
+        var label = select.parentNode;
         var url = 'enter_bug.cgi?product=' + encodeURIComponent(product.value) + '&component=' + encodeURIComponent(component.value);
-        span.innerHTML = "(<a href='" + url + "'>new</a>)";
-        if (select && span) {
-            select.parentNode.appendChild(span);
+        if (label) {
+          label.appendChild(d.createTextNode("("));
+          var link = d.createElement('a');
+          link.href = url;
+          link.textContent = "new";
+          link.title = "File a new bug in the same Product and Component";
+          var span = d.createElement('span');
+          span.appendChild(link);
+          label.appendChild(span);
+          label.appendChild(d.createTextNode(")"));
         }
     }
 }