mirror of
https://github.com/openwrt/luci.git
synced 2026-04-15 19:01:56 +00:00
068150ba5f
After the ES2016 rework, a very old bug was reverted where the WiFi SSID was
treated as raw HTML and directly appended to DOM.
This might result in XSS vulnerability with specially crafted SSID from the
Access Point around.
This is only triggered on opening the modal as the normal wireless.js view
doesn't scan the Access Point.
To fix this and make it more clear that SSID must be always escaped, move the
SSID handling to a dedicated variable and use the document.createTextNode()
to escape it similar to how it's done in similar place like the
channel_analysis.js
Fixes: cdce600aae ("luci-mod-network: give wireless.js ES2016 treatment and refactor")
Reported-by: Sasha Romijn <sct@mxsasha.eu>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
OpenWrt luci feed
Description
This is the OpenWrt "luci"-feed containing LuCI - OpenWrt Configuration Interface.
Usage
This feed is enabled by default. Your feeds.conf.default (or feeds.conf) should contain a line like:
src-git luci https://github.com/openwrt/luci.git
To install all its package definitions, run:
./scripts/feeds update luci
./scripts/feeds install -a -p luci
API Reference
You can browse the generated API documentation directly on Github.
Use ucode and rpcd for server side operations.
Development
Documentation for developing and extending LuCI can be found in the Wiki
License
See LICENSE file.
Package Guidelines
See CONTRIBUTING.md file.
Translation status
Use Weblate instead of direct editing of the *.po files.
