Hi David, On Sun, Jan 01, 2017 at 12:37:33PM +0000, David Harrigan wrote: > Happy New Year and thank you for your feedback. > > I think my patch may be safe, it's a one liner of JS. However, I do have to > reference > the server names somewhere, and I do that by obtaining the contents of the > px-id > (and ST_F_PXNAME) variables. > > What do you think? The patch may be dangerous? (I'm not that clued up on > JS injection tbh). I would be happy to use a different way if you can suggest > something?
We need to check the exact alphabet which is allowed for server names and/or if we currently encode it when dumping it in the HTML stats output. Hmmm I've just checked and we currently dump it as-is. The only allowed characters are [A-Za-z0-9_:.-] so that's fine, you won't unescape a string nor produce HTML contents with this. > Luckily, if JS is disabled on the browser, the "select all" checkbox won't do > anything :-) That's indeed the goal ;-) Willy
