(function(){ var main=document.querySelector("[data-kudo-wall]"); if(!main||main.getAttribute("data-kudo-card-popup")!=="1") return; var ctaLabel=main.getAttribute("data-kudo-cta-label")||""; var rawCta=main.getAttribute("data-kudo-cta-url")||""; /* Same sink guard as the embed script: this becomes an a.href. A plain string test, NOT a regex. This whole script is a template literal, and an escaped slash inside one collapses to a bare slash — so the old regex was emitted as /^https?:///i, and the resulting line comment swallowed the rest of the statement. ctaUrl was left holding a RegExp object: always truthy, so the guard passed everything, and a.href got the string "/^https?:/". The card CTA has never gone anywhere but a 404, and the URL check protecting it never ran. Backticks and escaped slashes are both hazards in here. Keep this comment, and this expression, free of them. */ var ctaUrl=(function(u){ var v=typeof u==="string"?u.toLowerCase():""; return (v.indexOf("http://")===0||v.indexOf("https://")===0)?u:""; })(rawCta); var overlay=null; function close(){ if(overlay){overlay.remove(); overlay=null; document.body.style.overflow=""; } } document.addEventListener("keydown",function(e){ if(e.key==="Escape") close(); }); document.addEventListener("click",function(e){ var t=e.target; if(!t||!t.closest) return; /* Photo tiles are ' +'' +'' +''; var ci=Math.min(Math.max(startAt,0),list.length-1); var shot=car.querySelector(".kudo-car-shot"); var cimg=car.querySelector("img"); var ccount=car.querySelector(".kudo-car-count"); function draw(){ cimg.src=list[ci]; cimg.alt="Photo "+(ci+1)+" of "+list.length; shot.setAttribute("data-kudo-photo", String(ci)); ccount.textContent=(ci+1)+" / "+list.length; car.setAttribute("data-single", list.length>1?"0":"1"); } function move(d){ ci=(ci+d+list.length)%list.length; draw(); } car.querySelector(".kudo-car-prev").addEventListener("click",function(e){e.preventDefault();e.stopPropagation();move(-1);}); car.querySelector(".kudo-car-next").addEventListener("click",function(e){e.preventDefault();e.stopPropagation();move(1);}); draw(); grid.parentNode.replaceChild(car, grid); } } box.appendChild(clone); if(ctaUrl&&ctaLabel){ var a=document.createElement("a"); a.href=ctaUrl; a.target="_blank"; a.rel="nofollow noopener noreferrer"; a.setAttribute("data-kudo-cta",""); a.className="kudo-wm-cta"; a.textContent=ctaLabel; box.appendChild(a); } var c=document.createElement("button"); c.type="button"; c.setAttribute("aria-label","Close"); c.className="kudo-wm-close"; c.textContent="✕"; c.addEventListener("click",close); box.appendChild(c); overlay.appendChild(box); overlay.addEventListener("click",function(ev){ if(ev.target===overlay) close(); }); document.body.appendChild(overlay); document.body.style.overflow="hidden"; }); })();