projects / oweals / luci.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: cf18bdd)
themes: ensure that data-page attribute is escaped
authorJo-Philipp Wich <jo@mein.io>
Sun, 15 Mar 2020 16:48:40 +0000 (17:48 +0100)
committerJo-Philipp Wich <jo@mein.io>
Sun, 15 Mar 2020 16:49:15 +0000 (17:49 +0100)
Fixes: #3757
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5d7dc391d4af4ad5dd6d7e1f6ef9891aa21fd220)

themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm patch | blob | history
themes/luci-theme-material/luasrc/view/themes/material/header.htm patch | blob | history
themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm patch | blob | history

diff --git a/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm b/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
index de1fd73f0e8c765eb02ba3a90b6ebd019de925db..d6910af7e13126cdf97866fc957f864e033dfb1e 100644 (file)
--- a/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
+++ b/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
@@ -151,7 +151,7 @@
                <script src="<%=resource%>/xhr.js"></script>
        </head>
 
-       <body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+       <body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
                <header>
                        <div class="fill">
                                <div class="container">
diff --git a/themes/luci-theme-material/luasrc/view/themes/material/header.htm b/themes/luci-theme-material/luasrc/view/themes/material/header.htm
index 76eeec05eba97d1b9aeedf12c403e48b74021287..e6cec4ad139b29e1c069ae2185f6939e3f6422d7 100644 (file)
--- a/themes/luci-theme-material/luasrc/view/themes/material/header.htm
+++ b/themes/luci-theme-material/luasrc/view/themes/material/header.htm
@@ -181,7 +181,7 @@
        <script src="<%=resource%>/cbi.js"></script>
        <script src="<%=resource%>/xhr.js"></script>
 </head>
-<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
 <header>
        <div class="fill">
                <div class="container">
diff --git a/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm b/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
index fbe030d18c54a98909f0a99b68346ffabaac1453..e5a69f8a6930f1dbea23b939de41c6d1ce45a720 100644 (file)
--- a/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
+++ b/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
@@ -187,7 +187,7 @@
 //]]></script>
 <title><%=striptags( (boardinfo.hostname or "?") .. ( (node and node.title) and ' - ' .. translate(node.title) or '')) %> - LuCI</title>
 </head>
-<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
 
 <p class="skiplink">
 <span id="skiplink1"><a href="#navigation"><%:Skip to navigation%></a></span>
Unnamed repository; edit this file 'description' to name the repository.