From 549a4e62786d5ce838e91c9ca00b2b8a76caa717 Mon Sep 17 00:00:00 2001
From: NguyenND <ngodanguyen@gmail.com>
Date: Mon, 23 Feb 2026 11:23:49 -0500
Subject: [PATCH] Phase 3: fixed template form editor

---
 app/routes/templates.py                  | 2 +-
 app/templates/templates/form_editor.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/routes/templates.py b/app/routes/templates.py
index b08f731..5abcc58 100644
--- a/app/routes/templates.py
+++ b/app/routes/templates.py
@@ -177,7 +177,7 @@ def form_editor(template_id):
     return render_template(
         'templates/form_editor.html',
         template=template,
-        form_schema_json=json.dumps(form_schema)
+        form_schema=form_schema          # pass the list — tojson handles encoding in the template
     )
 
 
diff --git a/app/templates/templates/form_editor.html b/app/templates/templates/form_editor.html
index acc6ca7..b5cb336 100644
--- a/app/templates/templates/form_editor.html
+++ b/app/templates/templates/form_editor.html
@@ -389,7 +389,7 @@
      This avoids using |safe which bypasses Jinja2 auto-escaping and could allow
      stored XSS if the sanitiser ever lets a malicious value through. #}
   <div id="schema-data"
-       data-schema="{{ form_schema_json | tojson }}"
+       data-schema="{{ form_schema | tojson }}"
        style="display:none;"></div>
 
   <!-- PROPERTIES -->