From 3c67f77555e636f949588c049c2074c70a1cbe33 Mon Sep 17 00:00:00 2001
From: Ted Trask <ttrask01@yahoo.com>
Date: Thu, 15 Jan 2009 21:44:39 +0000
Subject: Modified html.lua and viewlibrary.lua and all html files to
 html_escape variables before displaying them.

git-svn-id: svn://svn.alpinelinux.org/acf/alpine-baselayout/trunk@1678 ab2d0c66-481e-0410-8bed-d214d4d58bed
---
 health-networkstats-html.lsp | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

(limited to 'health-networkstats-html.lsp')

diff --git a/health-networkstats-html.lsp b/health-networkstats-html.lsp
index a19f71d..22b0a86 100644
--- a/health-networkstats-html.lsp
+++ b/health-networkstats-html.lsp
@@ -43,7 +43,7 @@
 	function Update(){
 		$.ajaxSetup({cache:false});
 		$.getJSON(
-			'<%= page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action %>',
+			'<%= html.html_escape(page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action) %>',
 			{viewtype:'json'},
 			function(data) {
 				if (lastdata != null){
@@ -100,16 +100,21 @@
 
 <H1>Network Statistics</H1>
 Network traffic in bytes/second
-<div id="chart" style="FLOAT: left; WIDTH: 600px; HEIGHT: 300px"></div>
-<div id="legend" style="FLOAT: left; margin-left: 10px; WIDTH: 50px"></div>
+
+<TABLE><TR><TD style="vertical-align:top;">
+<div id="chart" style="WIDTH: 100%; HEIGHT: 300px; MIN-WIDTH:600px;"></div></TD>
+<TD style="align:left;" WIDTH="140px"><div id="legend" style="margin-left: 10px; width: 130px;"></div></TD>
+</TR></TABLE>
+
+
 <DL>
 <DT>Display Options</DT>
 <DD><TABLE>
 <% for intf,val in pairs(view.value) do
 	local ipaddr = ""
 	if val.ipaddr then ipaddr = " ("..val.ipaddr..")" end %>
-	<TR><TD><input type="checkbox" name=<%= intf.."RX" %> checked="checked"><%= intf.." RX"..ipaddr %></input></TD>
-	<TD><input type="checkbox" name=<%= intf.."TX" %> checked="checked"><%= intf.." TX"..ipaddr %></input></TD></TR>
+	<TR><TD><input type="checkbox" name=<%= html.html_escape(intf).."RX" %> checked="checked"><%= html.html_escape(intf).." RX"..html.html_escape(ipaddr) %></input></TD>
+	<TD><input type="checkbox" name=<%= html.html_escape(intf).."TX" %> checked="checked"><%= html.html_escape(intf).." TX"..html.html_escape(ipaddr) %></input></TD></TR>
 <% end %>
 </TABLE></DD>
 <DT>Start / Stop</DT>
-- 
cgit v1.2.3