fix: validate custom color presets from localStorage

.github/workflows/auto-reply.yml

@@ -75,9 +75,9 @@ jobs:
               'Appreciate the effort you put into improving Paraline 👍'
             ].join('\n');
 
-            await github.rest.pulls.createComment({
+            await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number,
+              issue_number: context.payload.pull_request.number,
               body
             });

settings.js

@@ -268,7 +268,14 @@ document.addEventListener('DOMContentLoaded', () => {
 
     if (intervalMinutes) {
         intervalMinutes.addEventListener('change', (e) => {
-            const val = parseInt(e.target.value, 10) || 30;
+            let val = parseInt(e.target.value, 10);
+            if (isNaN(val)) {
+                val = 30;
+            }
+            // Clamp to the input's declared min/max (1-120) so the UI value
+            // always matches what actually gets saved and used.
+            val = Math.max(1, Math.min(120, val));
+            intervalMinutes.value = val;
             updateAutomationSetting({ checkIntervalMinutes: val });
         });
     }
@@ -584,6 +591,7 @@ document.addEventListener('DOMContentLoaded', () => {
     };
 
     // Load from local storage if available
+    const HEX_COLOR_RE = /^#[0-9a-fA-F]{6}$/;
     try {
         const savedPresets = localStorage.getItem('paraline_presets');
         if (savedPresets) {
@@ -592,7 +600,12 @@ document.addEventListener('DOMContentLoaded', () => {
             if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
                 const sanitized = {};
                 for (const [key, val] of Object.entries(parsed)) {
-                    if (isSafePresetName(key) && Array.isArray(val) && val.length === 3) {
+                    if (
+                        isSafePresetName(key) &&
+                        Array.isArray(val) &&
+                        val.length === 3 &&
+                        val.every(c => typeof c === "string" && HEX_COLOR_RE.test(c))
+                    ) {
                         sanitized[key] = val;
                     }
                 }