Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

themes: ensure that data-page attribute is escaped

Browse source 
Fixes: #3757
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5d7dc391d4)
This commit is contained in:
Jo-Philipp Wich 2020-03-15 17:48:40 +01:00
parent cf18bdde36
commit 06884b9502
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
View file

@ -151,7 +151,7 @@
<script src="<%=resource%>/xhr.js"></script>
</head>
<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
<header>
<div class="fill">
<div class="container">

2
themes/luci-theme-material/luasrc/view/themes/material/header.htm
View file

@ -181,7 +181,7 @@
<script src="<%=resource%>/cbi.js"></script>
<script src="<%=resource%>/xhr.js"></script>
</head>
<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
<header>
<div class="fill">
<div class="container">

2
themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
View file

@ -187,7 +187,7 @@
//]]></script>
<title><%=striptags( (boardinfo.hostname or "?") .. ( (node and node.title) and ' - ' .. translate(node.title) or '')) %> - LuCI</title>
</head>
<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
<p class="skiplink">
<span id="skiplink1"><a href="#navigation"><%:Skip to navigation%></a></span>