Hauke Mehrtens 139edfce8b themes: Call striptags() on hostname to prevent XSS ... This calls striptags() on the hostname to prevent any XSS over the hostname. This should fix CVE-2021-33425 as far as I understood it. If someone adds some Javascript into system.@system[0].hostname it would have been directly added to the page, this prevents the problem. This can only be exploited by someone being able to modify the uci configuration, normally a user with such privileges could also just modify the webpage. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 5cbd79d7e3)		2021-06-09 20:53:15 +02:00
..
htdocs/luci-static/material	luci-theme-material: fix wrong active state on common prefix node	2021-05-26 10:09:05 +03:00
luasrc/view/themes/material	themes: Call striptags() on hostname to prevent XSS	2021-06-09 20:53:15 +02:00
root/etc/uci-defaults	luci-theme-*: set mediaurlbase if it is the first time to be installed	2020-04-03 21:44:28 +08:00
Makefile	luci-theme-material: fix Makefile file mod	2020-05-04 12:44:03 +02:00