From bdf3ad085fcd9d37e3c44d33adb05dd215171df7 Mon Sep 17 00:00:00 2001
From: Jared Vititoe <jjvititoe1@gmail.com>
Date: Fri, 27 Mar 2026 14:22:11 -0400
Subject: [PATCH] audit pass 14: type=button on JS-generated button HTML
 strings

Add type="button" to all buttons created via innerHTML in JS:
- Lightbox close/prev/next buttons (3 instances)
- Pagination prev/page/ellipsis/next buttons (7 instances)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 base.js | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/base.js b/base.js
index 24867a6..37c4182 100644
--- a/base.js
+++ b/base.js
@@ -2538,9 +2538,9 @@
         _overlay.setAttribute('aria-modal', 'true');
         _overlay.setAttribute('aria-label', 'Image viewer');
         _overlay.innerHTML = `
-          <button class="lt-lightbox-close" aria-label="Close">&times;</button>
-          <button class="lt-lightbox-prev" aria-label="Previous">&#8249;</button>
-          <button class="lt-lightbox-next" aria-label="Next">&#8250;</button>
+          <button type="button" class="lt-lightbox-close" aria-label="Close">&times;</button>
+          <button type="button" class="lt-lightbox-prev" aria-label="Previous">&#8249;</button>
+          <button type="button" class="lt-lightbox-next" aria-label="Next">&#8250;</button>
           <div class="lt-lightbox-img-wrap">
             <img class="lt-lightbox-img" src="" alt="">
           </div>
@@ -2791,7 +2791,7 @@
         const pages = _pages();
         let html = '';
         // Prev
-        html += `<button class="lt-page-btn" ${page <= 1 ? 'disabled' : ''} data-page="${page - 1}" aria-label="Previous page">&laquo;</button>`;
+        html += `<button type="button" class="lt-page-btn" ${page <= 1 ? 'disabled' : ''} data-page="${page - 1}" aria-label="Previous page">&laquo;</button>`;
         // Page buttons with ellipsis
         const half = Math.floor((maxBtns - 2) / 2);
         let start = Math.max(2, page - half);
@@ -2800,15 +2800,15 @@
           if (start === 2) end   = Math.min(pages - 1, start + maxBtns - 3);
           else             start = Math.max(2,          end   - maxBtns + 3);
         }
-        html += `<button class="lt-page-btn${page === 1 ? ' active' : ''}" data-page="1"${page === 1 ? ' aria-current="page"' : ''} aria-label="Page 1">1</button>`;
-        if (start > 2)       html += `<button class="lt-page-btn" disabled aria-hidden="true">…</button>`;
+        html += `<button type="button" class="lt-page-btn${page === 1 ? ' active' : ''}" data-page="1"${page === 1 ? ' aria-current="page"' : ''} aria-label="Page 1">1</button>`;
+        if (start > 2)       html += `<button type="button" class="lt-page-btn" disabled aria-hidden="true">…</button>`;
         for (let i = start; i <= end; i++) {
-          html += `<button class="lt-page-btn${page === i ? ' active' : ''}" data-page="${i}"${page === i ? ' aria-current="page"' : ''} aria-label="Page ${i}">${i}</button>`;
+          html += `<button type="button" class="lt-page-btn${page === i ? ' active' : ''}" data-page="${i}"${page === i ? ' aria-current="page"' : ''} aria-label="Page ${i}">${i}</button>`;
         }
-        if (end < pages - 1) html += `<button class="lt-page-btn" disabled aria-hidden="true">…</button>`;
-        if (pages > 1) html += `<button class="lt-page-btn${page === pages ? ' active' : ''}" data-page="${pages}"${page === pages ? ' aria-current="page"' : ''} aria-label="Page ${pages}">${pages}</button>`;
+        if (end < pages - 1) html += `<button type="button" class="lt-page-btn" disabled aria-hidden="true">…</button>`;
+        if (pages > 1) html += `<button type="button" class="lt-page-btn${page === pages ? ' active' : ''}" data-page="${pages}"${page === pages ? ' aria-current="page"' : ''} aria-label="Page ${pages}">${pages}</button>`;
         // Next
-        html += `<button class="lt-page-btn" ${page >= pages ? 'disabled' : ''} data-page="${page + 1}" aria-label="Next page">&raquo;</button>`;
+        html += `<button type="button" class="lt-page-btn" ${page >= pages ? 'disabled' : ''} data-page="${page + 1}" aria-label="Next page">&raquo;</button>`;
         if (!nav.getAttribute('role')) nav.setAttribute('role', 'navigation');
         if (!nav.getAttribute('aria-label')) nav.setAttribute('aria-label', 'Pagination');
         nav.innerHTML = html;