From 5dabd44b533ee7a12f8dbd33a41c244398e3969b Mon Sep 17 00:00:00 2001
From: Administrator <admin@24-music.de>
Date: Sat, 21 Mar 2026 14:58:14 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix:=20add=20missing=20escapeAtt?=
 =?UTF-8?q?r=20on=20remote=20token=20input=20value?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Consistent with all other user-data HTML attribute insertions
in the codebase that use escapeAttr().

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 renderer/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/renderer/app.js b/renderer/app.js
index 7e4b40a..124e85f 100644
--- a/renderer/app.js
+++ b/renderer/app.js
@@ -2156,7 +2156,7 @@ function renderSettings() {
       </div>
       <div class="settings-row">
         <label>API-Token</label>
-        <input type="text" class="key-input" id="remoteTokenInput" value="${remoteSettings.token || ''}" readonly style="flex:1">
+        <input type="text" class="key-input" id="remoteTokenInput" value="${escapeAttr(remoteSettings.token || '')}" readonly style="flex:1">
         <button class="btn btn-xs btn-secondary" id="remoteCopyTokenBtn" title="Kopieren">Kopieren</button>
         <button class="btn btn-xs btn-secondary" id="remoteRegenerateTokenBtn" title="Neu generieren">Neu</button>
       </div>