From da8df981cb918ea5ed645ec3fdaf1f23f2e69049 Mon Sep 17 00:00:00 2001
From: Griatch <griatch@gmail.com>
Date: Mon, 30 Jun 2025 17:20:37 +0200
Subject: [PATCH] Fix possible Xscript exploit

---
 evennia/web/static/webclient/js/plugins/message_routing.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/evennia/web/static/webclient/js/plugins/message_routing.js b/evennia/web/static/webclient/js/plugins/message_routing.js
index e051c12fae..f379959f01 100644
--- a/evennia/web/static/webclient/js/plugins/message_routing.js
+++ b/evennia/web/static/webclient/js/plugins/message_routing.js
@@ -52,8 +52,8 @@ let spawns = (function () {
     //
     // display a row with proper editting hooks
     var displayRow = function (formdiv, div, regexstring, tagstring) {
-	var regex = $('<input class="regex" type=text value="'+regexstring+'"/>');
-	var tag = $('<input class="tag" type=text value="'+tagstring+'"/>'); 
+	var regex = $.find('<input class="regex" type=text value="'+regexstring+'"/>');
+	var tag = $.find('<input class="tag" type=text value="'+tagstring+'"/>'); 
 	var del = $('<input class="delete-regex" type=button value="X"/>'); 
         regex.on('change', onAlterTag );
         regex.on('focusin', onFocusIn );