Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #5109 from hauke/striptags-from-hostname

Browse source 
themes: Call striptags() on hostname to prevent XSS
This commit is contained in:
Jo-Philipp Wich 2021-06-09 08:48:04 +02:00 committed by GitHub
commit b35316298b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
View file

@ -41,7 +41,7 @@
<header>
<div class="fill">
<div class="container">
<a class="brand" href="/"><%=boardinfo.hostname or "?"%></a>
<a class="brand" href="/"><%=striptags(boardinfo.hostname or "?")%></a>
<ul class="nav" id="topmenu" style="display:none"></ul>
<div id="indicators" class="pull-right"></div>
</div>

2
themes/luci-theme-material/luasrc/view/themes/material/header.htm
View file

@ -190,7 +190,7 @@
<div class="container">
<span class="showSide"></span>
<a id="logo" href="<% if luci.dispatcher.context.authsession then %><%=url('admin/status/overview')%><% else %>#<% end %>"><img src="<%=media%>/brand.png" alt="OpenWrt"></a>
<a class="brand" href="#"><%=boardinfo.hostname or "?"%></a>
<a class="brand" href="#"><%=striptags(boardinfo.hostname or "?")%></a>
<div class="status" id="indicators">
<span id="xhr_poll_status" style="display:none" onclick="XHR.running() ? XHR.halt() : XHR.run()">
<span class="label success" id="xhr_poll_status_on"><span class="mobile-hide"><%:Auto Refresh%></span> <%:on%></span>

2
themes/luci-theme-openwrt-2020/luasrc/view/themes/openwrt2020/header.htm
View file

@ -43,7 +43,7 @@
<div id="menubar">
<h2 class="navigation"><a id="navigation" name="navigation"><%:Navigation%></a></h2>
<span class="hostname"><a href="/"><%=(boardinfo.hostname or "?")%></a></span>
<span class="hostname"><a href="/"><%=striptags(boardinfo.hostname or "?")%></a></span>
<span class="distversion"><%=ver.distversion%></span>
<span id="indicators"></span>
</div>

2
themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
View file

@ -50,7 +50,7 @@
<h2 class="navigation"><a id="navigation" name="navigation"><%:Navigation%></a></h2>
<div class="hostinfo">
<%=(boardinfo.hostname or "?")%> | <%=ver.distversion%> |
<%=striptags(boardinfo.hostname or "?")%> | <%=ver.distversion%> |
<%:Load%>: <%="%.2f" % (loadinfo[1] / 65535.0)%> <%="%.2f" % (loadinfo[2] / 65535.0)%> <%="%.2f" % (loadinfo[3] / 65535.0)%>
</div>