From 48a1f24ac992b4ceec1ae61fe42f4dd066ff4dd0 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Wed, 24 Sep 2025 15:55:27 -0400
Subject: [PATCH] Explain post-template data-play attribute assignment

---
 js/app.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/js/app.js b/js/app.js
index d765d784..5ef902c3 100644
--- a/js/app.js
+++ b/js/app.js
@@ -1736,6 +1736,10 @@ class bitvidApp {
           cardEl.dataset.torrentSupported = "true";
         }
         const interactiveEls = cardEl.querySelectorAll("[data-video-id]");
+        // We intentionally leave the data-play-* attributes blank in cardHtml and
+        // assign them after template parsing so the raw URL/magnet strings avoid
+        // HTML entity escaping in the literal markup and keep any sensitive
+        // magnet payloads out of the static DOM text.
         interactiveEls.forEach((el) => {
           if (!el.dataset) return;
           el.dataset.playUrl = playbackUrl || "";