From 165498206182c5e84a66521789e9939615b70ded Mon Sep 17 00:00:00 2001
From: Daniel Hart | ALifeInArtifyAI
 <238904666+projectedanx@users.noreply.github.com>
Date: Tue, 7 Jul 2026 00:24:44 +1000
Subject: [PATCH 1/3] Potential fix for code scanning alert no. 6: Unsafe HTML
 constructed from library input

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Daniel Hart | ALifeInArtifyAI <238904666+projectedanx@users.noreply.github.com>
---
 js/jquery.cal.js | 40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/js/jquery.cal.js b/js/jquery.cal.js
index 16c94f5b2..fc5a20651 100644
--- a/js/jquery.cal.js
+++ b/js/jquery.cal.js
@@ -84,18 +84,40 @@
 			table.append('<tbody></tbody>');
 			
 				// month select field
-				var monthselect = '<select name="month">';
-				for (var i in l10n_cal_month) monthselect += '<option value="'+i+'">'+l10n_cal_month[i]+'</option>';
-				monthselect += '</select>';
+				var monthselect = jQuery('<select name="month"></select>');
+				for (var i in l10n_cal_month) {
+					monthselect.append(jQuery('<option></option>').val(i).text(l10n_cal_month[i]));
+				}
 			
 				// year select field
-				var yearselect = '<select name="year">';
-				for (var i in years) yearselect += '<option>'+years[i]+'</option>';
-				yearselect += '</select>';
+				var yearselect = jQuery('<select name="year"></select>');
+				for (var i in years) {
+					yearselect.append(jQuery('<option></option>').text(years[i]));
+				}
 			
-			jQuery("thead",table).append('<tr class="controls"><th colspan="7"><span class="prevMonth">&laquo;</span>&nbsp;'+monthselect+yearselect+'&nbsp;<span class="nextMonth">&raquo;</span></th></tr>');
-			jQuery("thead",table).append('<tr class="days"><th>'+l10n_cal_days[0]+'</th><th>'+l10n_cal_days[1]+'</th><th>'+l10n_cal_days[2]+'</th><th>'+l10n_cal_days[3]+'</th><th>'+l10n_cal_days[4]+'</th><th>'+l10n_cal_days[5]+'</th><th>'+l10n_cal_days[6]+'</th></tr>');
-			jQuery("tfoot",table).append('<tr><td colspan="2"><span class="today">'+l10n_cal_today+'</span></td><td colspan="3">&nbsp;</td><td colspan="2"><span class="close">'+l10n_cal_close+'</span></td></tr>');
+			var controlsRow = jQuery('<tr class="controls"></tr>');
+			var controlsHeader = jQuery('<th colspan="7"></th>');
+			controlsHeader.append(jQuery('<span class="prevMonth"></span>').text('«'));
+			controlsHeader.append('\u00a0');
+			controlsHeader.append(monthselect);
+			controlsHeader.append(yearselect);
+			controlsHeader.append('\u00a0');
+			controlsHeader.append(jQuery('<span class="nextMonth"></span>').text('»'));
+			controlsRow.append(controlsHeader);
+			jQuery("thead",table).append(controlsRow);
+
+			var daysRow = jQuery('<tr class="days"></tr>');
+			for (var d = 0; d < 7; d++) {
+				daysRow.append(jQuery('<th></th>').text(l10n_cal_days[d]));
+			}
+			jQuery("thead",table).append(daysRow);
+
+			var tfootRow = jQuery('<tr></tr>');
+			tfootRow.append(jQuery('<td colspan="2"></td>').append(jQuery('<span class="today"></span>').text(l10n_cal_today)));
+			tfootRow.append(jQuery('<td colspan="3"></td>').html('&nbsp;'));
+			tfootRow.append(jQuery('<td colspan="2"></td>').append(jQuery('<span class="close"></span>').text(l10n_cal_close)));
+			jQuery("tfoot",table).append(tfootRow);
+
 			for (var i = 0; i < 6; i++) jQuery("tbody",table).append('<tr><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>');	
 			return table;
 		}

From 97a58c076bb522af2b5ec3988928bbcfefd94aa5 Mon Sep 17 00:00:00 2001
From: Daniel Hart | ALifeInArtifyAI
 <238904666+projectedanx@users.noreply.github.com>
Date: Tue, 7 Jul 2026 00:26:11 +1000
Subject: [PATCH 2/3] Update js/jquery.cal.js

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Signed-off-by: Daniel Hart | ALifeInArtifyAI <238904666+projectedanx@users.noreply.github.com>
---
 js/jquery.cal.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/js/jquery.cal.js b/js/jquery.cal.js
index fc5a20651..d6d575804 100644
--- a/js/jquery.cal.js
+++ b/js/jquery.cal.js
@@ -85,9 +85,9 @@
 			
 				// month select field
 				var monthselect = jQuery('<select name="month"></select>');
-				for (var i in l10n_cal_month) {
-					monthselect.append(jQuery('<option></option>').val(i).text(l10n_cal_month[i]));
-				}
+				jQuery.each(l10n_cal_month, function(i, monthName) {
+					monthselect.append(jQuery('<option></option>').val(i).text(monthName));
+				});
 			
 				// year select field
 				var yearselect = jQuery('<select name="year"></select>');

From d05deed8b101143fec67bdcb9e7427e5e912f876 Mon Sep 17 00:00:00 2001
From: Daniel Hart | ALifeInArtifyAI
 <238904666+projectedanx@users.noreply.github.com>
Date: Tue, 7 Jul 2026 00:26:20 +1000
Subject: [PATCH 3/3] Update js/jquery.cal.js

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Signed-off-by: Daniel Hart | ALifeInArtifyAI <238904666+projectedanx@users.noreply.github.com>
---
 js/jquery.cal.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/jquery.cal.js b/js/jquery.cal.js
index d6d575804..3e1e87d87 100644
--- a/js/jquery.cal.js
+++ b/js/jquery.cal.js
@@ -91,7 +91,7 @@
 			
 				// year select field
 				var yearselect = jQuery('<select name="year"></select>');
-				for (var i in years) {
+				for (var i = 0; i < years.length; i++) {
 					yearselect.append(jQuery('<option></option>').text(years[i]));
 				}