diff options
| author | Hauke Mehrtens <hauke@hauke-m.de> | 2021-06-09 01:28:44 +0200 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2021-06-09 01:33:44 +0200 |
| commit | 5cbd79d7e31c0f0feaea2770bf102bbae7831e3c (patch) | |
| tree | ac1d330cb1d8ecb385ccaad940ee5e4b6e685783 /themes/luci-theme-openwrt | |
| parent | da97288015e0a8919c55075d71d88890e2f339f3 (diff) | |
themes: Call striptags() on hostname to prevent XSS
This calls striptags() on the hostname to prevent any XSS over the
hostname. This should fix CVE-2021-33425 as far as I understood it.
If someone adds some Javascript into system.@system[0].hostname it would
have been directly added to the page, this prevents the problem.
This can only be exploited by someone being able to modify the uci
configuration, normally a user with such privileges could also just
modify the webpage.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'themes/luci-theme-openwrt')
| -rw-r--r-- | themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm b/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm index 5f79b386b2..a17f350263 100644 --- a/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm +++ b/themes/luci-theme-openwrt/luasrc/view/themes/openwrt.org/header.htm @@ -50,7 +50,7 @@ <h2 class="navigation"><a id="navigation" name="navigation"><%:Navigation%></a></h2> <div class="hostinfo"> - <%=(boardinfo.hostname or "?")%> | <%=ver.distversion%> | + <%=striptags(boardinfo.hostname or "?")%> | <%=ver.distversion%> | <%:Load%>: <%="%.2f" % (loadinfo[1] / 65535.0)%> <%="%.2f" % (loadinfo[2] / 65535.0)%> <%="%.2f" % (loadinfo[3] / 65535.0)%> </div> |