summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cron-listjobs-html.lsp4
-rw-r--r--health-modules-html.lsp2
-rw-r--r--health-network-html.lsp4
-rw-r--r--health-networkstats-html.lsp15
-rw-r--r--health-proc-html.lsp4
-rw-r--r--health-storage-html.lsp14
-rw-r--r--health-system-html.lsp14
-rw-r--r--hostname-html.lsp2
-rw-r--r--interfaces-read-html.lsp18
-rw-r--r--interfaces-update-html.lsp2
-rw-r--r--logfiles-status-html.lsp6
-rw-r--r--logfiles-tail-html.lsp4
-rw-r--r--logfiles-view-html.lsp6
-rw-r--r--modules-edit-html.lsp4
-rw-r--r--modules-status-html.lsp2
-rw-r--r--password-edit-html.lsp2
-rw-r--r--rc-edit-html.lsp2
-rw-r--r--rc-status-html.lsp18
-rw-r--r--skins-read-html.lsp4
19 files changed, 66 insertions, 61 deletions
diff --git a/cron-listjobs-html.lsp b/cron-listjobs-html.lsp
index 6f21673..d9705e0 100644
--- a/cron-listjobs-html.lsp
+++ b/cron-listjobs-html.lsp
@@ -10,7 +10,7 @@ end %>
<H1>Cron Jobs</H1>
<% for i,tabl in ipairs(view.value) do %>
-<H2><%= tabl.period %></H2>
+<H2><%= html.html_escape(tabl.period) %></H2>
<% if #tabl.jobs == 0 then %>
No jobs
<% else %>
@@ -25,7 +25,7 @@ No jobs
<%= html.link{value=page_info.script..page_info.prefix..page_info.controller.."/editjob?name="..job.."&redir="..page_info.orig_action, label="Edit "} %>
<%= html.link{value=page_info.script..page_info.prefix..page_info.controller.."/deletejob?name="..job, label="Delete "} %>
</TD>
- <TD style="white-space:nowrap;"><%= string.gsub(job, "^.*/", "") %></TD>
+ <TD style="white-space:nowrap;"><%= html.html_escape(string.gsub(job, "^.*/", "")) %></TD>
</TR>
<% end %>
</TABLE>
diff --git a/health-modules-html.lsp b/health-modules-html.lsp
index ee6e0ad..5ffcf97 100644
--- a/health-modules-html.lsp
+++ b/health-modules-html.lsp
@@ -3,4 +3,4 @@
<h1>Modules</h1>
<h2>Installed modules</h2>
-<pre><%= view.value.list.value %></pre>
+<pre><%= html.html_escape(view.value.list.value) %></pre>
diff --git a/health-network-html.lsp b/health-network-html.lsp
index d97322a..5d97a9e 100644
--- a/health-network-html.lsp
+++ b/health-network-html.lsp
@@ -3,7 +3,7 @@
<h1>Network</h1>
<h2>Interface status</h2>
-<pre><%= view.value.interfaces.value %></pre>
+<pre><%= html.html_escape(view.value.interfaces.value) %></pre>
<h2>Routes</h2>
-<pre><%= view.value.routes.value %></pre>
+<pre><%= html.html_escape(view.value.routes.value) %></pre>
diff --git a/health-networkstats-html.lsp b/health-networkstats-html.lsp
index a19f71d..22b0a86 100644
--- a/health-networkstats-html.lsp
+++ b/health-networkstats-html.lsp
@@ -43,7 +43,7 @@
function Update(){
$.ajaxSetup({cache:false});
$.getJSON(
- '<%= page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action %>',
+ '<%= html.html_escape(page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action) %>',
{viewtype:'json'},
function(data) {
if (lastdata != null){
@@ -100,16 +100,21 @@
<H1>Network Statistics</H1>
Network traffic in bytes/second
-<div id="chart" style="FLOAT: left; WIDTH: 600px; HEIGHT: 300px"></div>
-<div id="legend" style="FLOAT: left; margin-left: 10px; WIDTH: 50px"></div>
+
+<TABLE><TR><TD style="vertical-align:top;">
+<div id="chart" style="WIDTH: 100%; HEIGHT: 300px; MIN-WIDTH:600px;"></div></TD>
+<TD style="align:left;" WIDTH="140px"><div id="legend" style="margin-left: 10px; width: 130px;"></div></TD>
+</TR></TABLE>
+
+
<DL>
<DT>Display Options</DT>
<DD><TABLE>
<% for intf,val in pairs(view.value) do
local ipaddr = ""
if val.ipaddr then ipaddr = " ("..val.ipaddr..")" end %>
- <TR><TD><input type="checkbox" name=<%= intf.."RX" %> checked="checked"><%= intf.." RX"..ipaddr %></input></TD>
- <TD><input type="checkbox" name=<%= intf.."TX" %> checked="checked"><%= intf.." TX"..ipaddr %></input></TD></TR>
+ <TR><TD><input type="checkbox" name=<%= html.html_escape(intf).."RX" %> checked="checked"><%= html.html_escape(intf).." RX"..html.html_escape(ipaddr) %></input></TD>
+ <TD><input type="checkbox" name=<%= html.html_escape(intf).."TX" %> checked="checked"><%= html.html_escape(intf).." TX"..html.html_escape(ipaddr) %></input></TD></TR>
<% end %>
</TABLE></DD>
<DT>Start / Stop</DT>
diff --git a/health-proc-html.lsp b/health-proc-html.lsp
index 6e52d21..3105a1c 100644
--- a/health-proc-html.lsp
+++ b/health-proc-html.lsp
@@ -3,7 +3,7 @@
<h1>Process information</h1>
<h2>Processor</h2>
-<pre><%= view.value.processor.value %></pre>
+<pre><%= html.html_escape(view.value.processor.value) %></pre>
<h2>Memory</h2>
-<pre><%= view.value.memory.value %></pre>
+<pre><%= html.html_escape(view.value.memory.value) %></pre>
diff --git a/health-storage-html.lsp b/health-storage-html.lsp
index cd9162e..bd2a20a 100644
--- a/health-storage-html.lsp
+++ b/health-storage-html.lsp
@@ -1,22 +1,22 @@
<% local view = ... %>
<% displaydisk = function(disk, name)
-io.write("<pre>"..disk.value.."</pre>\n")
+io.write("<pre>"..html.html_escape(disk.value).."</pre>\n")
io.write('<TABLE STYLE="margin:0px;padding:0px;border:0px">\n')
io.write(" <TR>\n")
io.write(" <TD>0%</TD>\n")
if tonumber(disk.used) > 0 then
- io.write(' <TD WIDTH="'..disk.used..'%" STYLE="background:red;border:2px solid black;')
+ io.write(' <TD WIDTH="'..html.html_escape(disk.used)..'%" STYLE="background:red;border:2px solid black;')
if tonumber(disk.used) < 100 then io.write('border-right:none;') end
io.write('"><CENTER><B>')
- if ( tonumber(disk.used) > 10) then io.write(disk.used .. "%") end
+ if ( tonumber(disk.used) > 10) then io.write(html.html_escape(disk.used) .. "%") end
io.write('</B></CENTER></TD>\n')
end
if tonumber(disk.used) < 100 then
- io.write(' <TD WIDTH="'..(100-disk.used)..'%" STYLE="background:#0c0;border:2px solid black;')
+ io.write(' <TD WIDTH="'..(100-tonumber(disk.used))..'%" STYLE="background:#0c0;border:2px solid black;')
if tonumber(disk.used) > 0 then io.write('border-left:none;') end
io.write('"><CENTER><B>')
- if ( 90 > tonumber(disk.used)) then io.write((100-disk.used) .. "%") end
+ if ( 90 > tonumber(disk.used)) then io.write((100-tonumber(disk.used)) .. "%") end
io.write('</B></CENTER></TD>\n')
end
io.write(' <TD>100%</TD>\n')
@@ -24,7 +24,7 @@ io.write(" </TR>\n")
io.write("</TABLE>\n")
io.write('<TABLE STYLE="margin:0px;padding:0px;border:0px;margin-top:5px;">\n')
io.write(" <TR>\n")
-io.write(' <TD WIDTH="100px"><B>'..name..'</B></TD><TD STYLE="background:red;border:2px solid black;" WIDTH="20px"></TD><TD WIDTH="70px"><B>=Used</B></TD><TD STYLE="background:#0c0;border:2px solid black;" WIDTH="20px"></TD><TD><B>=Free</B></TD>\n')
+io.write(' <TD WIDTH="100px"><B>'..html.html_escape(name)..'</B></TD><TD STYLE="background:red;border:2px solid black;" WIDTH="20px"></TD><TD WIDTH="70px"><B>=Used</B></TD><TD STYLE="background:#0c0;border:2px solid black;" WIDTH="20px"></TD><TD><B>=Free</B></TD>\n')
io.write(" </TR>\n")
io.write("</TABLE>\n")
end %>
@@ -60,6 +60,6 @@ No RAM Disk mounted
<% if view.value.partitions then %>
<h2>Disk partitions</h2>
-<pre><%= view.value.partitions.value %></pre>
+<pre><%= html.html_escape(view.value.partitions.value) %></pre>
<% end %>
diff --git a/health-system-html.lsp b/health-system-html.lsp
index 8ee3572..9fcea6f 100644
--- a/health-system-html.lsp
+++ b/health-system-html.lsp
@@ -3,22 +3,22 @@
<h1>System</h1>
<h2>Versions and names</h2>
-<pre><%= view.value.version.value %></pre>
-<pre><%= view.value.uname.value %></pre>
+<pre><%= html.html_escape(view.value.version.value) %></pre>
+<pre><%= html.html_escape(view.value.uname.value) %></pre>
<h2>Uptime</h2>
-<pre><%= view.value.uptime.value %></pre>
+<pre><%= html.html_escape(view.value.uptime.value) %></pre>
<h2>Time/TimeZone</h2>
-<pre><%= view.value.date.value %></pre>
-<pre><%= view.value.timezone.value %></pre>
+<pre><%= html.html_escape(view.value.date.value) %></pre>
+<pre><%= html.html_escape(view.value.timezone.value) %></pre>
<h2>Memory</h2>
-<pre><%= view.value.memory.value %></pre>
+<pre><%= html.html_escape(view.value.memory.value) %></pre>
<TABLE STYLE="margin:0px;padding:0px;border:0px">
<TR>
- <TD>0%</TD><TD WIDTH="<%= view.value.memory.used %>%" STYLE="background:red;border:2px solid black;border-right:none;"><CENTER><B><% if ( tonumber(view.value.memory.used) > 10) then io.write(view.value.memory.used .. "%") end %></B></CENTER></TD><TD WIDTH="<%= (100-view.value.memory.used) %>%" STYLE="background:#0c0;border:2px solid black;border-left:none;""><CENTER><B><% if ( 90 > tonumber(view.value.memory.used)) then io.write((100-view.value.memory.used) .. "%") end %></B></CENTER></TD><TD>100%</TD>
+ <TD>0%</TD><TD WIDTH="<%= html.html_escape(view.value.memory.used) %>%" STYLE="background:red;border:2px solid black;border-right:none;"><CENTER><B><% if ( tonumber(view.value.memory.used) > 10) then io.write(html.html_escape(view.value.memory.used) .. "%") end %></B></CENTER></TD><TD WIDTH="<%= (100-tonumber(view.value.memory.used)) %>%" STYLE="background:#0c0;border:2px solid black;border-left:none;""><CENTER><B><% if ( 90 > tonumber(view.value.memory.used)) then io.write((100-tonumber(view.value.memory.used)) .. "%") end %></B></CENTER></TD><TD>100%</TD>
</TR>
</TABLE>
<TABLE STYLE="margin:0px;padding:0px;border:0px;margin-top:5px;">
diff --git a/hostname-html.lsp b/hostname-html.lsp
index cae18ae..52238b3 100644
--- a/hostname-html.lsp
+++ b/hostname-html.lsp
@@ -1,7 +1,7 @@
<% local view = ... %>
<% require("viewfunctions") %>
-<h1><%= view.label %></h1>
+<h1><%= html.html_escape(view.label) %></h1>
<DL>
<% displayitem(view) %>
</DL>
diff --git a/interfaces-read-html.lsp b/interfaces-read-html.lsp
index d0984dc..7504a1f 100644
--- a/interfaces-read-html.lsp
+++ b/interfaces-read-html.lsp
@@ -11,10 +11,10 @@ io.write("</span>")
<% showoption = function(option)
if option.errtxt or option.value ~= "" then %>
- <TR><TD WIDTH='120px' STYLE='font-weight:bold;border:none;'><%= option.label %></TD>
+ <TR><TD WIDTH='120px' STYLE='font-weight:bold;border:none;'><%= html.html_escape(option.label) %></TD>
<TD STYLE='border:none;'<% if option.errtxt then io.write("class='error'") end %>>
- <%= string.gsub(tostring(option.value), "\n", "<BR>") %>
- <% if option.errtxt then io.write("<BR>"..option.errtxt) end %>
+ <%= string.gsub(html.html_escape(tostring(option.value)), "\n", "<BR>") %>
+ <% if option.errtxt then io.write("<BR>"..html.html_escape(option.errtxt)) end %>
</TD></TR>
<% end %>
<% end %>
@@ -29,7 +29,7 @@ end %>
<DL>
<% for i,entry in ipairs(view.value) do
local interface = entry.value %>
- <DT><IMG SRC='/skins/static/tango/16x16/devices/network-wired.png' width='16' height='16'> <%= interface.name.value %></DT><DD>
+ <DT><IMG SRC='/skins/static/tango/16x16/devices/network-wired.png' width='16' height='16'> <%= html.html_escape(interface.name.value) %></DT><DD>
<TABLE STYLE='margin-bottom:10px'>
<%
@@ -42,16 +42,16 @@ end %>
end %>
<TR>
<% if session.permissions.interfaces.update then %>
- <A HREF='update?name=<%= interface.name.value %>&redir=read'>Edit </A>
+ <A HREF='update?name=<%= html.html_escape(interface.name.value) %>&redir=read'>Edit </A>
<% end
if session.permissions.interfaces.delete then %>
- <A HREF='delete?name=<%= interface.name.value %>'>Delete </A>
+ <A HREF='delete?name=<%= html.html_escape(interface.name.value) %>'>Delete </A>
<% end
if session.permissions.interfaces.ifup then %>
- <A HREF='ifup?name=<%= interface.name.value %>'>ifup </A>
+ <A HREF='ifup?name=<%= html.html_escape(interface.name.value) %>'>ifup </A>
<% end
if session.permissions.interfaces.ifdown then %>
- <A HREF='ifdown?name=<%= interface.name.value %>'>ifdown </A>
+ <A HREF='ifdown?name=<%= html.html_escape(interface.name.value) %>'>ifdown </A>
<% end %>
</TR>
</TABLE>
@@ -63,5 +63,5 @@ end %>
<P class="error">WARNING!!! Restarting networking may cause the ACF web interface to stop functioning. Try refreshing this page after restarting. If that fails, you may have to use terminal access to recover.</P>
<DL>
<DT>Restart Networking</DT>
-<DD><form action="<%= page_info.script .. page_info.prefix .. page_info.controller .. "/restart" %>"><input class="submit" type="submit" value="Restart"></form></DD>
+<DD><form action="<%= html.html_escape(page_info.script .. page_info.prefix .. page_info.controller .. "/restart") %>"><input class="submit" type="submit" value="Restart"></form></DD>
</DL>
diff --git a/interfaces-update-html.lsp b/interfaces-update-html.lsp
index d205c03..f796beb 100644
--- a/interfaces-update-html.lsp
+++ b/interfaces-update-html.lsp
@@ -151,7 +151,7 @@ io.write("</span>")
--]]
%>
-<h1><%= form.label %><% if page_info.action == "update" then io.write(" - "..form.value.name.value) end %></h1>
+<h1><%= html.html_escape(form.label) %><% if page_info.action == "update" then io.write(html.html_escape(" - "..form.value.name.value)) end %></h1>
<%
if page_info.action == "update" then
form.value.name.readonly = true
diff --git a/logfiles-status-html.lsp b/logfiles-status-html.lsp
index b4e98b4..2b2fa9e 100644
--- a/logfiles-status-html.lsp
+++ b/logfiles-status-html.lsp
@@ -31,9 +31,9 @@
<TD style="padding-right:20px;white-space:nowrap;"><%= html.link{value = "view?name="..file.value.filename.value, label="View" } %></TD>
<TD style="padding-right:20px;white-space:nowrap;"><%= html.link{value = "tail?name="..file.value.filename.value, label="Tail" } %></TD>
<TD style="padding-right:20px;white-space:nowrap;"><%= html.link{value = "download?name="..file.value.filename.value, label="Download" } %></TD>
- <TD style="padding-right:20px;white-space:nowrap;text-align:right"><%= file.value.filesize.value %></TD>
- <TD style="padding-right:20px;white-space:nowrap;"><%= file.value.mtime.value %></TD>
- <TD style="white-space:nowrap;"><%= file.value.filename.value %></TD>
+ <TD style="padding-right:20px;white-space:nowrap;text-align:right"><%= html.html_escape(file.value.filesize.value) %></TD>
+ <TD style="padding-right:20px;white-space:nowrap;"><%= html.html_escape(file.value.mtime.value) %></TD>
+ <TD style="white-space:nowrap;"><%= html.html_escape(file.value.filename.value) %></TD>
</TR>
<% end %>
</TABLE>
diff --git a/logfiles-tail-html.lsp b/logfiles-tail-html.lsp
index 72725ad..94bc4a8 100644
--- a/logfiles-tail-html.lsp
+++ b/logfiles-tail-html.lsp
@@ -8,8 +8,8 @@
function Update(){
$.ajaxSetup({cache:false});
$.getJSON(
- '<%= page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action %>',
- {name:'<% io.write(form.value.filename.value) if form.value.grep.value ~= "" then io.write("',grep:'"..form.value.grep.value) end %>', offset:currentoffset},
+ '<%= html.html_escape(page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action) %>',
+ {name:'<% io.write(html.html_escape(form.value.filename.value)) if form.value.grep.value ~= "" then io.write("',grep:'"..html.html_escape(form.value.grep.value)) end %>', offset:currentoffset},
function(data) {
data.value.filecontent.value = data.value.filecontent.value.split("\n").join("<br>\n");
diff --git a/logfiles-view-html.lsp b/logfiles-view-html.lsp
index 338a384..386eb91 100644
--- a/logfiles-view-html.lsp
+++ b/logfiles-view-html.lsp
@@ -23,13 +23,13 @@ end
<% if form.type == "form" then %>
<% form.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action %>
<% displayformstart(form) %>
-<input type="hidden" name="filename" value="<%= form.value.filename.value %>">
+<input type="hidden" name="filename" value="<%= html.html_escape(form.value.filename.value) %>">
<% end %>
<textarea name="filecontent">
<%= html.html_escape(form.value.filecontent.value) %>
</textarea>
-<% if form.value.filecontent.errtxt then %><P CLASS='error'><%= string.gsub(form.value.filecontent.errtxt, "\n", "<BR>") %></P><% end %>
-<% if form.value.filecontent.descr then %><P CLASS='descr'><%= string.gsub(form.value.filecontent.descr, "\n", "<BR>") %></P><% end %>
+<% if form.value.filecontent.errtxt then %><P CLASS='error'><%= string.gsub(html.html_escape(form.value.filecontent.errtxt), "\n", "<BR>") %></P><% end %>
+<% if form.value.filecontent.descr then %><P CLASS='descr'><%= string.gsub(html.html_escape(form.value.filecontent.descr), "\n", "<BR>") %></P><% end %>
<% if form.type == "form" then %>
<H3>Save</H3>
diff --git a/modules-edit-html.lsp b/modules-edit-html.lsp
index 75c360f..e3c0f8d 100644
--- a/modules-edit-html.lsp
+++ b/modules-edit-html.lsp
@@ -27,8 +27,8 @@ displayitem(form.value.mtime)
<textarea name="filecontent">
<%= html.html_escape(form.value.filecontent.value) %>
</textarea>
-<% if form.value.filecontent.errtxt then %><P CLASS='error'><%= string.gsub(form.value.filecontent.errtxt, "\n", "<BR>") %></P><% end %>
-<% if form.value.filecontent.descr then %><P CLASS='descr'><%= string.gsub(form.value.filecontent.descr, "\n", "<BR>") %></P><% end %>
+<% if form.value.filecontent.errtxt then %><P CLASS='error'><%= string.gsub(html.html_escape(form.value.filecontent.errtxt), "\n", "<BR>") %></P><% end %>
+<% if form.value.filecontent.descr then %><P CLASS='descr'><%= string.gsub(html.html_escape(form.value.filecontent.descr), "\n", "<BR>") %></P><% end %>
<% if form.type == "form" then %>
<H3>Save</H3>
diff --git a/modules-status-html.lsp b/modules-status-html.lsp
index 9854e28..8d797b5 100644
--- a/modules-status-html.lsp
+++ b/modules-status-html.lsp
@@ -3,4 +3,4 @@
<h1>Modules</h1>
<h2>Installed modules</h2>
-<pre><%= view.value %></pre>
+<pre><%= html.html_escape(view.value) %></pre>
diff --git a/password-edit-html.lsp b/password-edit-html.lsp
index d9582bf..257c319 100644
--- a/password-edit-html.lsp
+++ b/password-edit-html.lsp
@@ -2,7 +2,7 @@
require("viewfunctions")
%>
-<H1><%= form.label %></H1>
+<H1><%= html.html_escape(form.label) %></H1>
<%
form.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action
form.value.password.type = "password"
diff --git a/rc-edit-html.lsp b/rc-edit-html.lsp
index ad24179..5f18a14 100644
--- a/rc-edit-html.lsp
+++ b/rc-edit-html.lsp
@@ -2,7 +2,7 @@
require("viewfunctions")
%>
-<H1><%= form.label %></H1>
+<H1><%= html.html_escape(form.label) %></H1>
<%
form.action = page_info.script .. page_info.prefix .. page_info.controller .. "/" .. page_info.action
form.value.servicename.readonly = true
diff --git a/rc-status-html.lsp b/rc-status-html.lsp
index 3272af0..a234798 100644
--- a/rc-status-html.lsp
+++ b/rc-status-html.lsp
@@ -3,15 +3,15 @@
<% if session.editresult then %>
<H1>Command Result</H1>
- <% if session.editresult.errtxt then io.write('<P CLASS="error">' .. string.gsub(session.editresult.errtxt, "\n", "<BR>") .. "</P>\n") end
- if session.editresult.descr then io.write('<P CLASS="descr">' .. string.gsub(session.editresult.descr, "\n", "<BR>") .. "</P>\n") end
+ <% if session.editresult.errtxt then io.write('<P CLASS="error">' .. string.gsub(html.html_escape(session.editresult.errtxt), "\n", "<BR>") .. "</P>\n") end
+ if session.editresult.descr then io.write('<P CLASS="descr">' .. string.gsub(html.html_escape(session.editresult.descr), "\n", "<BR>") .. "</P>\n") end
for name,val in pairs(session.editresult.value) do
- if val.errtxt then io.write('<P CLASS="error">' .. string.gsub(val.errtxt, "\n", "<BR>") .. "</P>\n") end
+ if val.errtxt then io.write('<P CLASS="error">' .. string.gsub(html.html_escape(val.errtxt), "\n", "<BR>") .. "</P>\n") end
end
session.editresult = nil
end %>
-<H1><%= view.label %></H1>
+<H1><%= html.html_escape(view.label) %></H1>
<TABLE>
<TR>
<% if session.permissions.rc.edit then %>
@@ -28,14 +28,14 @@ for i,item in ipairs(view.value) do %>
for name,val in pairs(result.value) do val.name=name end
if result.value.kill.value then result.value.kill.checked = "" end
if result.value.system.value then result.value.system.checked = "" end %>
- <form action="<%= page_info.script .. page_info.prefix .. page_info.controller .. "/edit" %>" method="POST">
- <TD><input class="submit" type="submit" name="<%= result.option %>" value="<%= result.submit or result.option %>"></TD>
- <TD><%= item.servicename %><%= html.form.hidden(result.value.servicename) %></TD><TD><%= html.form.text(result.value.sequence) %></TD>
+ <form action="<%= html.html_escape(page_info.script .. page_info.prefix .. page_info.controller .. "/edit") %>" method="POST">
+ <TD><input class="submit" type="submit" name="<%= html.html_escape(result.option) %>" value="<%= html.html_escape(result.submit or result.option) %>"></TD>
+ <TD><%= html.html_escape(item.servicename) %><%= html.form.hidden(result.value.servicename) %></TD><TD><%= html.form.text(result.value.sequence) %></TD>
<TD><%= html.form.checkbox(result.value.kill) %></TD><TD><%= html.form.checkbox(result.value.system) %></TD>
</form></TR>
<% else %>
- <TD><%= item.servicename %></TD><TD><%= item.sequence %></TD>
- <TD><%= item.kill %></TD><TD><%= item.system %></TD></TR>
+ <TD><%= html.html_escape(item.servicename) %></TD><TD><%= html.html_escape(item.sequence) %></TD>
+ <TD><%= html.html_escape(item.kill) %></TD><TD><%= html.html_escape(item.system) %></TD></TR>
<% end %>
<% end %>
</TABLE>
diff --git a/skins-read-html.lsp b/skins-read-html.lsp
index 9bb70a0..95547a5 100644
--- a/skins-read-html.lsp
+++ b/skins-read-html.lsp
@@ -7,11 +7,11 @@
<DL>
<% for i,skin in ipairs(view.value) do %>
- <dt><%= skin.value %></dt>
+ <dt><%= html.html_escape(skin.value) %></dt>
<% if (skin.inuse) then %>
<dd>in use</dd>
<% else %>
- <dd>[<a href="update?skin=<%= skin.value %>">use this skin</a>]</dd>
+ <dd>[<a href="update?skin=<%= html.html_escape(skin.value) %>">use this skin</a>]</dd>
<% end %>
<% end %>
</DL>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-18 18:57:19 +0000