Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

themes: ensure that data-page attribute is escaped

Browse source 
Fixes: #3757
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2020-03-15 17:48:40 +01:00
parent 03af89a24b
commit 5d7dc391d4
3 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
View file

@ -40,7 +40,7 @@
<% include("themes/bootstrap/json-menu") %> <% include("themes/bootstrap/json-menu") %>
</head> </head>
<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>"> <body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
<header> <header>
<div class="fill"> <div class="fill">
<div class="container"> <div class="container">

2
themes/luci-theme-material/luasrc/view/themes/material/header.htm
View file

@ -184,7 +184,7 @@
})(); })();
//]]></script> //]]></script>
</head> </head>
<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>"> <body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
<header> <header>
<div class="fill"> <div class="fill">
<div class="container"> <div class="container">

2
themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
View file

@ -188,7 +188,7 @@
//]]></script> //]]></script>
<title><%=striptags( (boardinfo.hostname or "?") .. ( (node and node.title) and ' - ' .. translate(node.title) or '')) %> - LuCI</title> <title><%=striptags( (boardinfo.hostname or "?") .. ( (node and node.title) and ' - ' .. translate(node.title) or '')) %> - LuCI</title>
</head> </head>
<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= table.concat(disp.context.requestpath, "-") %>"> <body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
<p class="skiplink"> <p class="skiplink">
<span id="skiplink1"><a href="#navigation"><%:Skip to navigation%></a></span> <span id="skiplink1"><a href="#navigation"><%:Skip to navigation%></a></span>