Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
luci/themes
History
Hauke Mehrtens 15ca915da9 themes: Call striptags() on hostname to prevent XSS 
This calls striptags() on the hostname to prevent any XSS over the
hostname. This should fix CVE-2021-33425 as far as I understood it.

If someone adds some Javascript into system.@system[0].hostname it would
have been directly added to the page, this prevents the problem.

This can only be exploited by someone being able to modify the uci
configuration, normally a user with such privileges could also just
modify the webpage.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5cbd79d7e3)
2021-06-09 21:07:45 +02:00
..
luci-theme-bootstrap themes: Call striptags() on hostname to prevent XSS 2021-06-09 21:07:45 +02:00
luci-theme-material themes: Call striptags() on hostname to prevent XSS 2021-06-09 21:07:45 +02:00
luci-theme-openwrt themes: Call striptags() on hostname to prevent XSS 2021-06-09 21:07:45 +02:00