Use inline confirmation for extension deletion
Replace the native confirm dialog with the shared inline confirmation UI. Escape extension names before rendering the destructive prompt.
Alessandro committed
Jul 21, 2026 at 18:55 UTC
a592d3c9ab30e782c979356d9bd35fff3893019b
2 files changed
+13
-3
plugins/_browser/webui/browser-config-store.js
+9
-3
@@ -1,5 +1,6 @@
1
import { createStore } from "/js/AlpineStore.js";
2
import { callJsonApi } from "/js/api.js";
3
+import { showConfirmDialog } from "/js/confirmDialog.js";
4
5
const BROWSER_EXTENSIONS_API = "/plugins/_browser/extensions";
6
const BROWSER_STATUS_API = "/plugins/_browser/status";
@@ -449,9 +450,14 @@ export const store = createStore("browserConfig", {
450
return;
451
}
452
const name = String(extension?.name || "this extension").trim();
452
- if (globalThis.confirm && !globalThis.confirm(`Delete ${name}? This removes the extension folder from Browser.`)) {
453
- return;
454
- }
453
+ const safeName = name.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
454
+ const confirmed = await showConfirmDialog({
455
+ title: "Delete extension",
456
+ message: `Delete ${safeName}? This removes the extension folder from Browser.`,
457
+ confirmText: "Delete",
458
+ type: "danger",
459
+ });
460
+ if (!confirmed) return;
461
462
this.extensionDeleteLoadingPath = path;
463
try {
tests/test_browser_agent_regressions.py
+4
@@ -1238,6 +1238,10 @@ def test_browser_extension_settings_stay_user_facing():
1238
assert "extensionDeleteTitle(extension)" in config_html
1239
assert "deleteExtension(extension)" in config_html
1240
assert "Delete extension" in config_store
1241
+ assert 'import { showConfirmDialog } from "/js/confirmDialog.js";' in config_store
1242
+ assert "const safeName = name.replace" in config_store
1243
+ assert "const confirmed = await showConfirmDialog({" in config_store
1244
+ assert "globalThis.confirm" not in config_store
1245
assert "<textarea" not in config_html
1246
assert "Enabled extension directories" not in config_html
1247
assert "Chrome Web Store URL installs" not in config_html