projects / project / luci.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 03af89a)
themes: ensure that data-page attribute is escaped
authorJo-Philipp Wich <jo@mein.io>
Sun, 15 Mar 2020 16:48:40 +0000 (17:48 +0100)
committerJo-Philipp Wich <jo@mein.io>
Sun, 15 Mar 2020 16:48:40 +0000 (17:48 +0100)
Fixes: #3757
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm patch | blob | history
themes/luci-theme-material/luasrc/view/themes/material/header.htm patch | blob | history
themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm patch | blob | history

diff --git a/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm b/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
index 56a1b230e40228c9c46e1391c55508cf4ce27319..b9e1fbcdb6a270af6d93f7c638c1ad61f65591ec 100644 (file)
--- a/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
+++ b/themes/luci-theme-bootstrap/luasrc/view/themes/bootstrap/header.htm
@@ -40,7 +40,7 @@
                <% include("themes/bootstrap/json-menu") %>
        </head>
 
-       <body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+       <body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><%- end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
                <header>
                        <div class="fill">
                                <div class="container">
diff --git a/themes/luci-theme-material/luasrc/view/themes/material/header.htm b/themes/luci-theme-material/luasrc/view/themes/material/header.htm
index 7541d048c00c98bd703cc9eb2d2272edb3bb6327..124314039a82a72d2343a4353226c06097d91f05 100644 (file)
--- a/themes/luci-theme-material/luasrc/view/themes/material/header.htm
+++ b/themes/luci-theme-material/luasrc/view/themes/material/header.htm
@@ -184,7 +184,7 @@
                })();
        //]]></script>
 </head>
-<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+<body class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
 <header>
        <div class="fill">
                <div class="container">
diff --git a/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm b/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
index a5e64cac5aa0f1c0f5e9152be87ca23768eb2b53..f691e7066d68b573a533330b171c8e07c04c51f2 100644 (file)
--- a/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
+++ b/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm
@@ -188,7 +188,7 @@
 //]]></script>
 <title><%=striptags( (boardinfo.hostname or "?") .. ( (node and node.title) and ' - ' .. translate(node.title) or '')) %> - LuCI</title>
 </head>
-<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+<body class="lang_<%=luci.i18n.context.lang%>" data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
 
 <p class="skiplink">
 <span id="skiplink1"><a href="#navigation"><%:Skip to navigation%></a></span>
Lua Configuration Interface (mirror)