BPI/luci
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

luci-app-openvpn: fix potential XSS in pageswitch template

Browse Source 
Ensure to escape URL instance parameter displayed in the heading.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 25983b9fa572a640a7ecd077378df2790266cd61)
This commit is contained in:
Jo-Philipp Wich 2023-01-13 21:16:58 +01:00
parent aa7938d4cb
commit 749268a2ca
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm
View File

@ -9,7 +9,7 @@
<div class="cbi-section">
<h3>
<a href="<%=url('admin/vpn/openvpn')%>"><%:Overview%></a> &#187;
<%=luci.i18n.translatef("Instance \"%s\"", self.instance)%>
<%=luci.i18n.translatef("Instance \"%s\"", pcdata(self.instance))%>
</h3>
<% if self.mode == "basic" then %>
<a href="<%=url('admin/vpn/openvpn/advanced', self.instance)%>"><%:Switch to advanced configuration%> &#187;</a><p/>