From 3fb9aa9f84782ae791a748c1f4a51ec8c21db543 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Kucharczyk?= <lukas@kucharczyk.xyz>
Date: Sat, 13 Jun 2026 22:17:10 +0200
Subject: [PATCH] Fix session-count script rendered as visible text
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_GET_SESSION_COUNT_SCRIPT was a mark_safe string used as a child of the
view_game content tree. Under the "only Safe nodes render unescaped" rule, a
mark_safe *string* child is escaped — so the <script> showed as literal text
on the page. Make it a Safe node (and drop the now-unused mark_safe import).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 games/views/game.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/games/views/game.py b/games/views/game.py
index a781dc0..618f6a2 100644
--- a/games/views/game.py
+++ b/games/views/game.py
@@ -8,7 +8,7 @@ from django.middleware.csrf import get_token
 from django.shortcuts import get_object_or_404, redirect
 from django.template.defaultfilters import date as date_filter
 from django.urls import reverse
-from django.utils.safestring import SafeText, mark_safe
+from django.utils.safestring import SafeText
 
 from common.components import (
     Fragment,
@@ -791,7 +791,7 @@ def _history_section(game: Game) -> SafeText:
     )
 
 
-_GET_SESSION_COUNT_SCRIPT = mark_safe(
+_GET_SESSION_COUNT_SCRIPT = Safe(
     "<script>\n"
     "            function getSessionCount() {\n"
     "                return document.getElementById('session-count')"