diff options
| author | Manuel Munz <freifunk@somakoma.de> | 2010-12-05 18:53:00 +0000 |
|---|---|---|
| committer | Manuel Munz <freifunk@somakoma.de> | 2010-12-05 18:53:00 +0000 |
| commit | a5e14ba6b2a1517660726a9664327a16d129c2f7 (patch) | |
| tree | 9e2f2eda8ee6a963b64dae76f05d1142879dc6de | |
| parent | 8027502b3595f7810d29abdf1adac6476461ddda (diff) | |
modules/freifunk: Prevent injections
| -rw-r--r-- | modules/freifunk/luasrc/view/freifunk-services/services.htm | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/modules/freifunk/luasrc/view/freifunk-services/services.htm b/modules/freifunk/luasrc/view/freifunk-services/services.htm index 650ef43a4..735a43205 100644 --- a/modules/freifunk/luasrc/view/freifunk-services/services.htm +++ b/modules/freifunk/luasrc/view/freifunk-services/services.htm @@ -64,10 +64,12 @@ end for k, line in ipairs(table) do local field = {} -- split line at # and |, 1=url, 2=proto, 3=description, 4=source - local field = luci.util.split(line, "[#|]", split, true) %> + local field = luci.util.split(line, "[#|]", split, true) + url,descr,origin = pcdata(field[1]),pcdata(field[3]),pcdata(field[4]) + %> <tr class="cbi-section-table-row cbi-rowstyle-<%=i%>"> - <td class="cbi-section-table-cell"><a href="<%=field[1]%>"><%=field[3]%></a></td> - <td class="cbi-section-table-cell"><%=field[4]%></td> + <td class="cbi-section-table-cell"><a href="<%=url%>"><%=descr%></a></td> + <td class="cbi-section-table-cell"><%=origin%></td> </tr> <% if i == 1 then i = 0 elseif i == 0 then i = 1 end %> <%end%> |