0
0
mirror of https://github.com/openwrt/luci.git synced 2025-02-11 20:30:57 +00:00
Jo-Philipp Wich 25983b9fa5 luci-app-openvpn: fix potential XSS in pageswitch template
Ensure to escape URL instance parameter displayed in the heading.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2023-01-13 21:18:09 +01:00

31 lines
1.0 KiB
HTML

<%#
Copyright 2008 Steven Barth <steven@midlink.org>
Copyright 2008 Jo-Philipp Wich <jow@openwrt.org>
Licensed to the public under the Apache License 2.0.
-%>
<%+openvpn/ovpn_css%>
<div class="cbi-section">
<h3>
<a href="<%=url('admin/vpn/openvpn')%>"><%:Overview%></a> &#187;
<%=luci.i18n.translatef("Instance \"%s\"", pcdata(self.instance))%>
</h3>
<% if self.mode == "basic" then %>
<a href="<%=url('admin/vpn/openvpn/advanced', self.instance)%>"><%:Switch to advanced configuration%> &#187;</a><p/>
<hr />
<% elseif self.mode == "advanced" then %>
<a href="<%=url('admin/vpn/openvpn/basic', self.instance)%>"><%:Switch to basic configuration%> &#187;</a><p/>
<hr />
<%:Configuration category%>:
<% for i, c in ipairs(self.categories) do %>
<% if c.id == self.category then %>
<strong><%=c.title%></strong>
<% else %>
<a href="<%=luci.dispatcher.build_url("admin", "vpn", "openvpn", "advanced", self.instance, c.id)%>"><%=c.title%></a>
<% end %>
<% if next(self.categories, i) then %>|<% end %>
<% end %>
<% end %>
</div>