From 32f0ff25a2ef28b58eae62688ecdb9d23dc91df0 Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Mon, 29 Mar 2021 11:45:01 +0200 Subject: luci-app-dawn: fix custom markup - Properly indent HTML markup - Replace div-based table markup with actual tables - Escape SSID, hostname and interface values to prevent potential XSS Fixes: #4942 Signed-off-by: Jo-Philipp Wich --- .../luasrc/model/cbi/dawn/dawn_hearing_map.lua | 120 ++++++++--------- .../luasrc/model/cbi/dawn/dawn_network.lua | 150 ++++++++++----------- 2 files changed, 132 insertions(+), 138 deletions(-) (limited to 'applications/luci-app-dawn') diff --git a/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_hearing_map.lua b/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_hearing_map.lua index 844fa72c43..d277865503 100644 --- a/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_hearing_map.lua +++ b/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_hearing_map.lua @@ -4,69 +4,65 @@ m.pageaction = false s = m:section(NamedSection, "__hearingmap__") function s.render(self, sid) - local tpl = require "luci.template" - tpl.render_string([[ - <% - local utl = require "luci.util" - local status = require "luci.tools.ieee80211" - local stat = utl.ubus("dawn", "get_hearing_map", { }) - local name, macs + local tpl = require "luci.template" + tpl.render_string([[ + <% + local utl = require "luci.util" + local xml = require "luci.xml" + local status = require "luci.tools.ieee80211" + local stat = utl.ubus("dawn", "get_hearing_map", { }) + local name, macs - for name, macs in pairs(stat) do - %> -
-

SSID: <%= name %>

-
-
-
Client MAC
-
AP MAC
-
Frequency
-
HT Sup
-
VHT Sup
-
Signal
-
RCPI
-
RSNI
-
Channel Utilization
-
Station connect to AP
-
Score
-
- <% - local mac, data - for mac, data in pairs(macs) do - local mac2, data2 - local count_loop = 0 + for name, macs in pairs(stat) do + %> +
+

SSID: <%= xml.pcdata(name) %>

+ + + + + + + + + + + + + + + <% + local mac, data + for mac, data in pairs(macs) do - for mac2, data2 in pairs(data) do - %> -
- <% if (count_loop == 0) then %> -
<%= mac %>
- <% else %> -
- <% end %> -
<%= mac2 %>
-
<%= "%.3f" %( data2.freq / 1000 ) %> GHz Channel: <%= "%d" %( status.frequency_to_channel(data2.freq) ) %>
-
<%= (data2.ht_capabilities == true and data2.ht_support == true) and "True" or "False" %>
-
<%= (data2.vht_capabilities == true and data2.vht_support == true) and "True" or "False" %>
-
<%= "%d" %data2.signal %>
-
<%= "%d" %data2.rcpi %>
-
<%= "%d" %data2.rsni %>
-
<%= "%.2f" %(data2.channel_utilization / 2.55) %> %
-
<%= "%d" %data2.num_sta %>
-
<%= "%d" %data2.score %>
-
- <% - count_loop = count_loop + 1 - end - end - %> - - - <% - end - %> - - ]]) + local mac2, data2 + local count_loop = 0 + for mac2, data2 in pairs(data) do + %> + + + + + + + + + + + + + + <% + count_loop = count_loop + 1 + end + end + %> +
Client MACAP MACFrequencyHT SupVHT SupSignalRCPIRSNIChannel UtilizationStation connect to APScore
<%= (count_loop == 0) and mac or "" %><%= mac2 %><%= "%.3f" %( data2.freq / 1000 ) %> GHz Channel: <%= "%d" %( status.frequency_to_channel(data2.freq) ) %><%= (data2.ht_capabilities == true and data2.ht_support == true) and "True" or "False" %><%= (data2.vht_capabilities == true and data2.vht_support == true) and "True" or "False" %><%= "%d" % data2.signal %><%= "%d" % data2.rcpi %><%= "%d" % data2.rsni %><%= "%.2f" % (data2.channel_utilization / 2.55) %> %<%= "%d" % data2.num_sta %><%= "%d" % data2.score %>
+
+ <% + end + %> + ]]) end -return m \ No newline at end of file +return m diff --git a/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_network.lua b/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_network.lua index 222778162b..6b6d6e346f 100644 --- a/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_network.lua +++ b/applications/luci-app-dawn/luasrc/model/cbi/dawn/dawn_network.lua @@ -9,86 +9,84 @@ function s.render(self, sid) local utl = require "luci.util" tpl.render_string([[ <% - local status = require "luci.tools.ieee80211" - local utl = require "luci.util" - local sys = require "luci.sys" - local hosts = sys.net.host_hints() - local stat = utl.ubus("dawn", "get_network", { }) - local name, macs - for name, macs in pairs(stat) do + local status = require "luci.tools.ieee80211" + local utl = require "luci.util" + local sys = require "luci.sys" + local xml = require "luci.xml" + local hosts = sys.net.host_hints() + local stat = utl.ubus("dawn", "get_network", { }) + local name, macs + for name, macs in pairs(stat) do %> -
-

SSID: <%= name %>

-
-
-
AP
-
Clients
-
- <% - local mac, data - for mac, data in pairs(macs) do - %> -
-
-
-
-
Hostname
-
Interface
-
MAC
-
Utilization
-
Frequency
-
Stations
-
HT Sup
-
VHT Sup
-
-
-
<%= data.hostname %>
-
<%= data.iface %>
-
<%= mac %>
-
<%= "%.2f" %(data.channel_utilization / 2.55) %> %
-
<%= "%.3f" %( data.freq / 1000 ) %> GHz (Channel: <%= "%d" %( status.frequency_to_channel(data.freq) ) %>)
-
<%= "%d" %data.num_sta %>
-
<%= (data.ht_support == true) and "available" or "not available" %>
-
<%= (data.vht_support == true) and "available" or "not available" %>
-
-
-
-
-
-
-
MAC
-
HT
-
VHT
-
Signal
-
- <% - local mac2, data2 - for clientmac, clientvals in pairs(data) do - if (type(clientvals) == "table") then - %> -
-
<%= clientmac %>
-
<%= (clientvals.ht == true) and "available" or "not available" %>
-
<%= (clientvals.vht == true) and "available" or "not available" %>
-
<%= "%d" %clientvals.signal %>
-
- <% - end - %> - <% - end - %> -
-
-
- <% - end - %> -
+

SSID: <%= xml.pcdata(name) %>

+ + + + + + <% + local mac, data + for mac, data in pairs(macs) do + %> + + + + + <% + end + %> +
APClients
+ + + + + + + + + + + + + + + + + + + + + +
HostnameInterfaceMACUtilizationFrequencyStationsHT SupVHT Sup
<%= xml.pcdata(data.hostname) %><%= xml.pcdata(data.iface) %><%= mac %><%= "%.2f" %(data.channel_utilization / 2.55) %> %<%= "%.3f" %( data.freq / 1000 ) %> GHz (Channel: <%= "%d" %( status.frequency_to_channel(data.freq) ) %>)<%= "%d" % data.num_sta %><%= (data.ht_support == true) and "available" or "not available" %><%= (data.vht_support == true) and "available" or "not available" %>
+ 		+ + + + + + + + <% + local mac2, data2 + for clientmac, clientvals in pairs(data) do + if (type(clientvals) == "table") then + %> + + + + + + + <% + end + end + %> +
MACHTVHTSignal
<%= clientmac %><%= (clientvals.ht == true) and "available" or "not available" %><%= (clientvals.vht == true) and "available" or "not available" %><%= "%d" % clientvals.signal %>
+
<% - end + end %> ]]) end -- cgit v1.2.3