From 7c32501e1865001169601eccfe6136043a45a4c1 Mon Sep 17 00:00:00 2001
From: Maxim Dolgolyov <maxim.dolgolyov@gmail.com>
Date: Sat, 30 May 2026 21:29:00 +0300
Subject: [PATCH] =?UTF-8?q?fix(admin):=20=D0=BE=D1=82=D0=BE=D0=B1=D1=80?=
 =?UTF-8?q?=D0=B0=D0=B6=D0=B0=D1=82=D1=8C=20HTML-=D1=80=D0=B0=D0=B7=D0=BC?=
 =?UTF-8?q?=D0=B5=D1=82=D0=BA=D1=83=20=D0=B2=D0=BE=D0=BF=D1=80=D0=BE=D1=81?=
 =?UTF-8?q?=D0=BE=D0=B2=20=D0=B2=20=D1=81=D0=B5=D0=BA=D1=86=D0=B8=D0=B8=20?=
 =?UTF-8?q?=C2=AB=D0=92=D0=BE=D0=BF=D1=80=D0=BE=D1=81=D1=8B=C2=BB=20=D0=BF?=
 =?UTF-8?q?=D1=80=D0=B8=20allow=5Fhtml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Секция игнорировала флаг allow_html и всегда экранировала текст/опции/
пояснение, из-за чего <div class=task-figure><img>, <b> и пр. показывались
как сырой текст. Теперь — как в test-run.html: allow_html ? raw : esc.
Также добавлен q.allow_html в SELECT списка вопросов (его не было в ответе API).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/src/controllers/questionController.js | 2 +-
 frontend/js/admin/sections/questions.js       | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/backend/src/controllers/questionController.js b/backend/src/controllers/questionController.js
index 02575cb..54b8521 100644
--- a/backend/src/controllers/questionController.js
+++ b/backend/src/controllers/questionController.js
@@ -44,7 +44,7 @@ function list(req, res) {
 
   const sql = `
     SELECT q.id, q.text, q.type, q.correct_text, q.difficulty, q.explanation, q.image,
-           q.year, q.source_type,
+           q.year, q.source_type, q.allow_html,
            t.name AS topic, t.id AS topic_id,
            s.name AS subject_name, s.slug AS subject_slug,
            (SELECT json_group_array(json_object(
diff --git a/frontend/js/admin/sections/questions.js b/frontend/js/admin/sections/questions.js
index 57bbe26..4e2e44e 100644
--- a/frontend/js/admin/sections/questions.js
+++ b/frontend/js/admin/sections/questions.js
@@ -71,15 +71,15 @@
         const diffCls = `diff-${q.difficulty}`;
         const optsHtml = (q.options || []).map(o =>
           `<div class="q-opt-row ${o.is_correct ? 'correct' : ''}">
-             <span class="q-opt-icon">${o.is_correct ? '<i data-lucide="check" style="width:13px;height:13px"></i>' : '<svg class="ic" viewBox="0 0 24 24"><circle cx="12" cy="12" r="8"/></svg>'}</span>${esc(o.text)}
+             <span class="q-opt-icon">${o.is_correct ? '<i data-lucide="check" style="width:13px;height:13px"></i>' : '<svg class="ic" viewBox="0 0 24 24"><circle cx="12" cy="12" r="8"/></svg>'}</span>${q.allow_html ? o.text : esc(o.text)}
            </div>`).join('');
         const explHtml = q.explanation
-          ? `<div class="q-expl"><strong>Пояснение:</strong> ${esc(q.explanation)}</div>` : '';
+          ? `<div class="q-expl"><strong>Пояснение:</strong> ${q.allow_html ? q.explanation : esc(q.explanation)}</div>` : '';
         return `<div class="q-card" id="qcard-${q.id}">
           <div class="q-card-head">
             <span class="q-card-num">#${q.id}</span>
             <div class="q-card-body" onclick="toggleQDetail(${q.id})">
-              <div class="q-card-text">${esc(q.text)}</div>
+              <div class="q-card-text">${q.allow_html ? q.text : esc(q.text)}</div>
               <div class="q-card-meta">
                 ${q.subject_name ? `<span class="q-badge q-badge-subj">${esc(q.subject_name)}</span>` : ''}
                 ${q.topic ? `<span class="q-badge q-badge-topic">${esc(q.topic)}</span>` : ''}