From 7ea1f38a0fb002a0a7ae82b1f37e30b96ba3503b Mon Sep 17 00:00:00 2001
From: j <j@mailb.org>
Date: Fri, 19 Mar 2021 10:19:19 +0100
Subject: [PATCH 1/2] check body

---
 pandora/websocket/worker.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pandora/websocket/worker.py b/pandora/websocket/worker.py
index 1a0e633d..9a3d7bd4 100644
--- a/pandora/websocket/worker.py
+++ b/pandora/websocket/worker.py
@@ -24,7 +24,7 @@ class Worker(ConsumerMixin):
 
     def process_task(self, body, message):
         try:
-            if body['task'] == 'trigger_event':
+            if isinstance(body, dict) and body.get('task') == 'trigger_event':
                 daemon.trigger_event(*body['args'])
         except:
             logger.error('faild to trigger event %s', body, exc_info=True)

From 4689af20505946b1325231b3a9412ac868871277 Mon Sep 17 00:00:00 2001
From: j <j@mailb.org>
Date: Fri, 19 Mar 2021 10:19:29 +0100
Subject: [PATCH 2/2] replace all not just first

---
 static/js/utils.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/static/js/utils.js b/static/js/utils.js
index a94bed6c..574e4a87 100644
--- a/static/js/utils.js
+++ b/static/js/utils.js
@@ -2659,8 +2659,9 @@ pandora.openURL = function(url) {
 };
 
 pandora.safeDocumentName = function(name) {
-    ['?', '#', '%'].forEach(function(c) {
-        name = name.replace(c, '_');
+    ['\\?', '#', '%', '/'].forEach(function(c) {
+        var r = new RegExp(c, 'g')
+        name = name.replace(r, '_');
     })
     return name;
 };