Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

treewide: avoid double-escaping CBI section labels

Browse source 
Since the section labels are already HTML-escaped implicitely by the
striptags() function, we must not escape them again in attr() or
ifattr().

Fixes: #2524
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2019-02-12 08:32:02 +01:00
parent 4141243762
commit eda8f02dac
4 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
applications/luci-app-adblock/luasrc/view/adblock/blocklist.htm
View file

@ -27,7 +27,7 @@ local anonclass = (not self.anonymous or self.sectiontitle) and "named" or "ano
for i, k in ipairs(self:cfgsections()) do for i, k in ipairs(self:cfgsections()) do
section = k section = k
local sectionname = striptags((type(self.sectiontitle) == "function") and self:sectiontitle(section) or k) local sectionname = striptags((type(self.sectiontitle) == "function") and self:sectiontitle(section) or k)
local sectiontitle = ifattr(sectionname and (not self.anonymous or self.sectiontitle), "data-title", sectionname) local sectiontitle = ifattr(sectionname and (not self.anonymous or self.sectiontitle), "data-title", sectionname, true)
isempty = false isempty = false
scope = { valueheader = "cbi/cell_valueheader", valuefooter = "cbi/cell_valuefooter" } scope = { valueheader = "cbi/cell_valueheader", valuefooter = "cbi/cell_valuefooter" }
-%> -%>

2
applications/luci-app-banip/luasrc/view/banip/sourcelist.htm
View file

@ -27,7 +27,7 @@ local anonclass = (not self.anonymous or self.sectiontitle) and "named" or "ano
for i, k in ipairs(self:cfgsections()) do for i, k in ipairs(self:cfgsections()) do
section = k section = k
local sectionname = striptags((type(self.sectiontitle) == "function") and self:sectiontitle(section) or k) local sectionname = striptags((type(self.sectiontitle) == "function") and self:sectiontitle(section) or k)
local sectiontitle = ifattr(sectionname and (not self.anonymous or self.sectiontitle), "data-title", sectionname) local sectiontitle = ifattr(sectionname and (not self.anonymous or self.sectiontitle), "data-title", sectionname, true)
isempty = false isempty = false
scope = { valueheader = "cbi/cell_valueheader", valuefooter = "cbi/cell_valuefooter" } scope = { valueheader = "cbi/cell_valueheader", valuefooter = "cbi/cell_valuefooter" }
-%> -%>

4
modules/luci-base/luasrc/view/cbi/cell_valueheader.htm
View file

@ -6,7 +6,7 @@
<div class="td cbi-value-field<% if self.error and self.error[section] then %> cbi-value-error<% end %>"<%= <div class="td cbi-value-field<% if self.error and self.error[section] then %> cbi-value-error<% end %>"<%=
attr("data-name", self.option) .. attr("data-name", self.option) ..
ifattr(ftype and #ftype > 0, "data-type", ftype) .. ifattr(ftype and #ftype > 0, "data-type", ftype) ..
ifattr(title and #title > 0, "data-title", title) .. ifattr(title and #title > 0, "data-title", title, true) ..
ifattr(descr and #descr > 0, "data-description", descr) ifattr(descr and #descr > 0, "data-description", descr, true)
%>> %>>
<div id="cbi-<%=self.config.."-"..section.."-"..self.option%>" data-index="<%=self.index%>" data-depends="<%=pcdata(self:deplist2json(section))%>"> <div id="cbi-<%=self.config.."-"..section.."-"..self.option%>" data-index="<%=self.index%>" data-depends="<%=pcdata(self:deplist2json(section))%>">

2
modules/luci-base/luasrc/view/cbi/tblsection.htm
View file

@ -127,7 +127,7 @@ end
section = k section = k
local sectionname = striptags((type(self.sectiontitle) == "function") and self:sectiontitle(section) or k) local sectionname = striptags((type(self.sectiontitle) == "function") and self:sectiontitle(section) or k)
local sectiontitle = ifattr(sectionname and (not self.anonymous or self.sectiontitle), "data-title", sectionname) local sectiontitle = ifattr(sectionname and (not self.anonymous or self.sectiontitle), "data-title", sectionname, true)
local colorclass = (self.extedit or self.rowcolors) and rowstyle() or "" local colorclass = (self.extedit or self.rowcolors) and rowstyle() or ""
local scope = { local scope = {
valueheader = "cbi/cell_valueheader", valueheader = "cbi/cell_valueheader",