From 4927e10d44b9f9f2ee6f9656d96be4a950fdd707 Mon Sep 17 00:00:00 2001
From: Sergey Konovalov <Sergey.Konovalov@onlyoffice.com>
Date: Tue, 24 Mar 2026 19:10:38 +0300
Subject: [PATCH] [wopi] Replace vulnerable "<%-" with "<%="; Fix bug 80768

---
 apps/api/wopi/convert-and-edit-wopi.ejs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/api/wopi/convert-and-edit-wopi.ejs b/apps/api/wopi/convert-and-edit-wopi.ejs
index a2d411c55f..c040767387 100644
--- a/apps/api/wopi/convert-and-edit-wopi.ejs
+++ b/apps/api/wopi/convert-and-edit-wopi.ejs
@@ -195,7 +195,7 @@ button:disabled, button[disabled]{
             </div>
         </div>
     </div>
-
+    <input id="statusHandler" type="hidden" value="<%= statusHandler || '' %>">
     <script type="text/javascript" language="javascript">
 
 		function redirect(url) {
@@ -253,7 +253,7 @@ button:disabled, button[disabled]{
         
 		var convertFile = function () {
 
-            let statusHandler = <%- JSON.stringify(statusHandler) %>;
+            let statusHandler = document.getElementById('statusHandler').value || null;
 			
 			if(!statusHandler) {
 				error();