fix(security): sanitize remote IP headers and escape log viewer output

#4135

1 files changed, 5 insertions, 1 deletions

diff --git a/web/html/login.html b/web/html/login.html
index 78bffd30..2e03a4c5 100644
--- a/web/html/login.html
+++ b/web/html/login.html
@@ -150,7 +150,11 @@
       },
       initHeadline() {
         const animationDelay = 2000;
-        const headlines = this.$el.querySelectorAll('.headline');
+        const rootEl = this.$el instanceof Element ? this.$el : document.getElementById('app');
+        if (!rootEl || typeof rootEl.querySelectorAll !== 'function') {
+          return;
+        }
+        const headlines = rootEl.querySelectorAll('.headline');
         headlines.forEach((headline) => {
           const first = headline.querySelector('.is-visible');
           if (!first) return;