From bcce01a1f65df04f80be9991e737d957a8617dac Mon Sep 17 00:00:00 2001
From: Krishna Suravarapu <36037520+KrishnaSuravarapu@users.noreply.github.com>
Date: Tue, 14 Jul 2026 18:42:14 +0530
Subject: [PATCH] Potential fix for code scanning alert no. 84: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 templates/EnigmaOps/allUserAccessList.html | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/templates/EnigmaOps/allUserAccessList.html b/templates/EnigmaOps/allUserAccessList.html
index bd565c38..4ca3a452 100644
--- a/templates/EnigmaOps/allUserAccessList.html
+++ b/templates/EnigmaOps/allUserAccessList.html
@@ -109,13 +109,15 @@
 
   function revokeConfirm(access_type_or_id, username=null){
     current_username = username
-    html = "<h4> Revoke Request ID: "+access_type_or_id+"?</h4>"
+    var message = "Revoke Request ID: " + access_type_or_id + "?"
     if(access_type_or_id.startsWith("module-")){
-      html = "<h4> Revoke all accesses for user "+username+" for "+access_type_or_id+"?</h4>"
+      message = "Revoke all accesses for user " + username + " for " + access_type_or_id + "?"
     }
     revokeButton = document.getElementsByName("final-revoke-button")[0]
     revokeButton.id = access_type_or_id
-    $("#revoke-details").html(html)
+    var $details = $("#revoke-details");
+    $details.empty();
+    $details.append($("<h4>").text(message));
   }
 
   function openType(elem) {