2897a1ceba
Use DOM-based textContent instead of raw string in Leaflet bindPopup() to prevent HTML injection via location titles. Authored-by: Moko Consulting