From 756f7b35a7b856e6d4be4e7a760ea238b83319a6 Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Thu, 6 Aug 2026 15:31:55 -0700
Subject: [PATCH 1/2] RG-T117 View call fix

---
 .../Areas/User/Views/Dispatch/ViewCall.cshtml | 40 +++++++++++++------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml b/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
index 4eb0b192..e34cf80a 100644
--- a/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
+++ b/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
@@ -964,22 +964,36 @@
     <script type="text/javascript">
         var callId = @(Model.Call.CallId);
 
-        var newCallForm = $('#fb-template').formRender({
-            dataType: 'json',
-            formData: '@Html.Raw(Model.Call.CallFormData)',
-            notify: {
-                error: function(message) {
-
-                },
-                success: function(message) {
-                    $('input, textarea, select', '.rendered-form').attr('readonly', true).attr('disabled', true)
-                },
-                warning: function(message) {
+        var callFormData = @Html.Raw(Newtonsoft.Json.JsonConvert.SerializeObject(Model.Call.CallFormData ?? string.Empty, new Newtonsoft.Json.JsonSerializerSettings { StringEscapeHandling = Newtonsoft.Json.StringEscapeHandling.EscapeHtml }));
+
+        // CallFormData is API-writable free text; older/external clients stored plain text
+        // (e.g. "Submitted ...") which formRender's JSON.parse can't handle. Only render the
+        // form for valid formBuilder data, otherwise show the raw text read-only.
+        var callFormFields = null;
+        try {
+            callFormFields = JSON.parse(callFormData);
+        } catch (e) { }
+
+        if (Array.isArray(callFormFields)) {
+            var newCallForm = $('#fb-template').formRender({
+                dataType: 'json',
+                formData: callFormData,
+                notify: {
+                    error: function(message) {
+
+                    },
+                    success: function(message) {
+                        $('input, textarea, select', '.rendered-form').attr('readonly', true).attr('disabled', true)
+                    },
+                    warning: function(message) {
 
+                    }
                 }
-            }
 
-        });
+            });
+        } else if (callFormData) {
+            $('#fb-template').text(callFormData);
+        }
     </script>
 
     <script src="~/js/app/common/signalr/resgrid.common.signalr.js" type="text/javascript"></script>

From 6004aada54f84b20cbc5323351c6ac3043c92f0c Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Thu, 6 Aug 2026 15:42:26 -0700
Subject: [PATCH 2/2] RG-T117 PR#448 fixes

---
 .../Areas/User/Views/Dispatch/ViewCall.cshtml | 23 +++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml b/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
index e34cf80a..e5638ece 100644
--- a/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
+++ b/Web/Resgrid.Web/Areas/User/Views/Dispatch/ViewCall.cshtml
@@ -975,15 +975,34 @@
         } catch (e) { }
 
         if (Array.isArray(callFormFields)) {
+            // form-render inserts label/option/description content as HTML and its sanitizer is a
+            // no-op unless DOMPurify is loaded (it isn't). CallFormData is API-writable, so escape
+            // the HTML-rendered props and show them as plain text.
+            var escapeHtml = function (value) {
+                return typeof value === 'string'
+                    ? value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;')
+                    : value;
+            };
+            callFormFields.forEach(function (field) {
+                if (!field || typeof field !== 'object') return;
+                field.label = escapeHtml(field.label);
+                field.description = escapeHtml(field.description);
+                if (Array.isArray(field.values)) {
+                    field.values.forEach(function (option) {
+                        if (option && typeof option === 'object') option.label = escapeHtml(option.label);
+                    });
+                }
+            });
+
             var newCallForm = $('#fb-template').formRender({
                 dataType: 'json',
-                formData: callFormData,
+                formData: JSON.stringify(callFormFields),
                 notify: {
                     error: function(message) {
 
                     },
                     success: function(message) {
-                        $('input, textarea, select', '.rendered-form').attr('readonly', true).attr('disabled', true)
+                        $('input, textarea, select, button', '#fb-template .rendered-form').attr('readonly', true).attr('disabled', true)
                     },
                     warning: function(message) {