luci-mod-admin-full: escape display parameter

[project/luci.git] / modules / luci-mod-admin-full / luasrc / view / admin_system / packages.htm

diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm b/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm
index 1ceda47..88e0fff 100644 (file)
--- a/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm
+++ b/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm
@@ -44,19 +44,20 @@ end
 
 <%+header%>
 
-<h2><a id="content" name="content"><%:Software%></a></h2>
+<h2 name="content"><%:Software%></h2>
 
-<form method="post" action="<%=REQUEST_URI%>">
-       <div class="cbi-map">
+<div class="cbi-map">
 
-               <ul class="cbi-tabmenu">
-                       <li class="cbi-tab"><a href="#"><%:Actions%></a></li>
-                       <li class="cbi-tab-disabled"><a href="<%=REQUEST_URI%>/ipkg"><%:Configuration%></a></li>
-               </ul>
-
-               <fieldset class="cbi-section">
+       <ul class="cbi-tabmenu">
+               <li class="cbi-tab"><a href="#"><%:Actions%></a></li>
+               <li class="cbi-tab-disabled"><a href="<%=REQUEST_URI%>/ipkg"><%:Configuration%></a></li>
+       </ul>
 
+       <form method="post" action="<%=REQUEST_URI%>">
+               <input type="hidden" name="exec" value="1" />
+               <input type="hidden" name="token" value="<%=token%>" />
 
+               <fieldset class="cbi-section">
                        <fieldset class="cbi-section-node">
                                <% if (install and next(install)) or (remove and next(remove)) or update or upgrade then %>
                                <div class="cbi-value">
@@ -68,7 +69,7 @@ end
                                <% if querypat then %>
                                <div class="cbi-value">
                                        <%:Displaying only packages containing%> <strong>"<%=pcdata(query)%>"</strong>
-                                       <input type="button" onclick="location.href='?display=<%=pcdata(display)%>'" href="#" class="cbi-button cbi-button-reset" style="margin-left:1em" value="<%:Reset%>" />
+                                       <input type="button" onclick="location.href='?display=<%=luci.http.urlencode(display)%>'" href="#" class="cbi-button cbi-button-reset" style="margin-left:1em" value="<%:Reset%>" />
                                        <br style="clear:both" />
                                </div>
                                <% end %>
@@ -80,7 +81,7 @@ end
                                        <% else %>
                                                <%:No package lists available%>
                                        <% end %>
-                                       <input type="button" onclick="location.href='?update=1'" href="#" class="cbi-button cbi-button-apply" style="margin-left:3em" value="<%:Update lists%>" />
+                                       <input type="submit" name="update" href="#" class="cbi-button cbi-button-apply" style="margin-left:3em" value="<%:Update lists%>" />
                                </div>
                                <% end %>
 
@@ -101,7 +102,7 @@ end
                                        <label class="cbi-value-title"><%:Download and install package%>:</label>
                                        <div class="cbi-value-field">
                                                <input type="text" name="url" size="30" value="" />
-                                               <input class="cbi-button cbi-input-save" type="submit" name="submit" value="<%:OK%>" />
+                                               <input class="cbi-button cbi-input-save" type="submit" name="go" value="<%:OK%>" />
                                        </div>
                                </div>
 
@@ -114,80 +115,98 @@ end
                                </div>
                        </fieldset>
                </fieldset>
-               <br />
-
-               <h3><%:Status%></h3>
-
-
-               <ul class="cbi-tabmenu">
-                       <li class="cbi-tab<% if display ~= "installed" then %>-disabled<% end %>"><a href="?display=installed&amp;query=<%=pcdata(query)%>"><%:Installed packages%><% if query then %> (<%=pcdata(query)%>)<% end %></a></li>
-                       <li class="cbi-tab<% if display ~= "available" then %>-disabled<% end %>"><a href="?display=available&amp;query=<%=pcdata(query)%>"><%:Available packages%><% if query then %> (<%=pcdata(query)%>)<% end %></a></li>
-               </ul>
-
-               <% if display ~= "available" then %>
-                       <fieldset class="cbi-section">
-                               <table class="cbi-section-table" style="width:100%">
-                                       <tr class="cbi-section-table-titles">
-                                               <th class="cbi-section-table-cell" style="text-align:left">&#160;</th>
-                                               <th class="cbi-section-table-cell" style="text-align:left"><%:Package name%></th>
-                                               <th class="cbi-section-table-cell" style="text-align:left"><%:Version%></th>
-                                       </tr>
-                                       <% local empty = true; luci.model.ipkg.list_installed(querypat, function(n, v, d) empty = false; filter[n] = true %>
-                                       <tr class="cbi-section-table-row cbi-rowstyle-<%=rowstyle()%>">
-                                               <td style="text-align:left; width:10%"><a onclick="return window.confirm('<%:Remove%> &quot;<%=luci.util.pcdata(n)%>&quot; ?')" href="<%=REQUEST_URI%>?submit=1&amp;remove=<%=luci.util.pcdata(n)%>"><%:Remove%></a></td>
-                                               <td style="text-align:left"><%=luci.util.pcdata(n)%></td>
-                                               <td style="text-align:left"><%=luci.util.pcdata(v)%></td>
-                                       </tr>
-                                       <% end) %>
-                                       <% if empty then %>
-                                       <tr class="cbi-section-table-row">
-                                               <td style="text-align:left">&#160;</td>
-                                               <td style="text-align:left"><em><%:none%></em></td>
-                                               <td style="text-align:left"><em><%:none%></em></td>
-                                       </tr>
-                                       <% end %>
-                               </table>
-                       </fieldset>
-               <% else %>
-                       <fieldset class="cbi-section">
-                       <% if not querypat then %>
-                               <ul class="cbi-tabmenu">
-                                       <% local i; for i = 65, 90 do %>
-                                       <li class="cbi-tab<% if letter ~= i then %>-disabled<% end %>"><a href="?display=available&amp;letter=<%=string.char(i)%>"><%=string.char(i)%></a></li>
-                                       <% end %>
-                                       <li class="cbi-tab<% if letter ~= 35 then %>-disabled<% end %>"><a href="?display=available&amp;letter=%23">#</a></li>
-                               </ul>
-                               <div class="cbi-section-node">
-                       <% end %>
-                               <table class="cbi-section-table" style="width:100%">
-                                       <tr class="cbi-section-table-titles">
-                                               <th class="cbi-section-table-cell" style="text-align:left">&#160;</th>
-                                               <th class="cbi-section-table-cell" style="text-align:left"><%:Package name%></th>
-                                               <th class="cbi-section-table-cell" style="text-align:left"><%:Version%></th>
-                                               <th class="cbi-section-table-cell" style="text-align:left"><%:Description%></th>
-                                       </tr>
-                                       <% local empty = true; opkg_list(querypat or letterpat, function(n, v, d) if filter[n] then return end; empty = false %>
-                                       <tr class="cbi-section-table-row cbi-rowstyle-<%=rowstyle()%>">
-                                               <td style="text-align:left; width:10%"><a onclick="return window.confirm('<%:Install%> &quot;<%=luci.util.pcdata(n)%>&quot; ?')" href="<%=REQUEST_URI%>?submit=1&amp;install=<%=luci.util.pcdata(n)%>"><%:Install%></a></td>
-                                               <td style="text-align:left"><%=luci.util.pcdata(n)%></td>
-                                               <td style="text-align:left"><%=luci.util.pcdata(v)%></td>
-                                               <td style="text-align:left"><%=luci.util.pcdata(d)%></td>
-                                       </tr>
-                                       <% end) %>
-                                       <% if empty then %>
-                                       <tr class="cbi-section-table-row">
-                                               <td style="text-align:left">&#160;</td>
-                                               <td style="text-align:left"><em><%:none%></em></td>
-                                               <td style="text-align:left"><em><%:none%></em></td>
-                                               <td style="text-align:left"><em><%:none%></em></td>
-                                       </tr>
-                                       <% end %>
-                               </table>
-                       <% if not querypat then %>
-                               </div>
-                       <% end %>
-                       </fieldset>
+       </form>
+
+
+       <h3><%:Status%></h3>
+
+
+       <ul class="cbi-tabmenu">
+               <li class="cbi-tab<% if display ~= "installed" then %>-disabled<% end %>"><a href="?display=installed&amp;query=<%=pcdata(query)%>"><%:Installed packages%><% if query then %> (<%=pcdata(query)%>)<% end %></a></li>
+               <li class="cbi-tab<% if display ~= "available" then %>-disabled<% end %>"><a href="?display=available&amp;query=<%=pcdata(query)%>"><%:Available packages%><% if query then %> (<%=pcdata(query)%>)<% end %></a></li>
+       </ul>
+
+       <% if display ~= "available" then %>
+               <fieldset class="cbi-section">
+                       <table class="cbi-section-table" style="width:100%">
+                               <tr class="cbi-section-table-titles">
+                                       <th class="cbi-section-table-cell" style="text-align:left">&#160;</th>
+                                       <th class="cbi-section-table-cell" style="text-align:left"><%:Package name%></th>
+                                       <th class="cbi-section-table-cell" style="text-align:left"><%:Version%></th>
+                               </tr>
+                               <% local empty = true; luci.model.ipkg.list_installed(querypat, function(n, v, s, d) empty = false; filter[n] = true %>
+                               <tr class="cbi-section-table-row cbi-rowstyle-<%=rowstyle()%>">
+                                       <td style="text-align:left; width:10%">
+                                               <form method="post" class="inline" action="<%=REQUEST_URI%>">
+                                                       <input type="hidden" name="exec" value="1" />
+                                                       <input type="hidden" name="token" value="<%=token%>" />
+                                                       <input type="hidden" name="remove" value="<%=pcdata(n)%>" />
+                                                       <a onclick="window.confirm('<%:Remove%> &quot;<%=luci.util.pcdata(n)%>&quot; ?') &#38;&#38; this.parentNode.submit(); return false" href="#"><%:Remove%></a>
+                                               </form>
+                                       </td>
+                                       <td style="text-align:left"><%=luci.util.pcdata(n)%></td>
+                                       <td style="text-align:left"><%=luci.util.pcdata(v)%></td>
+                               </tr>
+                               <% end) %>
+                               <% if empty then %>
+                               <tr class="cbi-section-table-row">
+                                       <td style="text-align:left">&#160;</td>
+                                       <td style="text-align:left"><em><%:none%></em></td>
+                                       <td style="text-align:left"><em><%:none%></em></td>
+                               </tr>
+                               <% end %>
+                       </table>
+               </fieldset>
+       <% else %>
+               <fieldset class="cbi-section">
+               <% if not querypat then %>
+                       <ul class="cbi-tabmenu">
+                               <% local i; for i = 65, 90 do %>
+                               <li class="cbi-tab<% if letter ~= i then %>-disabled<% end %>"><a href="?display=available&amp;letter=<%=string.char(i)%>"><%=string.char(i)%></a></li>
+                               <% end %>
+                               <li class="cbi-tab<% if letter ~= 35 then %>-disabled<% end %>"><a href="?display=available&amp;letter=%23">#</a></li>
+                       </ul>
+                       <div class="cbi-section-node">
+               <% end %>
+                       <table class="cbi-section-table" style="width:100%">
+                               <tr class="cbi-section-table-titles">
+                                       <th class="cbi-section-table-cell" style="text-align:left">&#160;</th>
+                                       <th class="cbi-section-table-cell" style="text-align:left"><%:Package name%></th>
+                                       <th class="cbi-section-table-cell" style="text-align:left"><%:Version%></th>
+                                       <th class="cbi-section-table-cell" style="text-align:right"><%:Size (.ipk)%></th>
+                                       <th class="cbi-section-table-cell" style="text-align:left"><%:Description%></th>
+                               </tr>
+                               <% local empty = true; opkg_list(querypat or letterpat, function(n, v, s, d) if filter[n] then return end; empty = false %>
+                               <tr class="cbi-section-table-row cbi-rowstyle-<%=rowstyle()%>">
+                                       <td style="text-align:left; width:10%">
+                                               <form method="post" class="inline" action="<%=REQUEST_URI%>">
+                                                       <input type="hidden" name="exec" value="1" />
+                                                       <input type="hidden" name="token" value="<%=token%>" />
+                                                       <input type="hidden" name="install" value="<%=pcdata(n)%>" />
+                                                       <a onclick="window.confirm('<%:Install%> &quot;<%=luci.util.pcdata(n)%>&quot; ?') &#38;&#38; this.parentNode.submit(); return false" href="#"><%:Install%></a>
+                                               </form>
+                                       </td>
+                                       <td style="text-align:left"><%=luci.util.pcdata(n)%></td>
+                                       <td style="text-align:left"><%=luci.util.pcdata(v)%></td>
+                                       <td style="text-align:right"><%=luci.util.pcdata(s)%></td>
+                                       <td style="text-align:left"><%=luci.util.pcdata(d)%></td>
+                               </tr>
+                               <% end) %>
+                               <% if empty then %>
+                               <tr class="cbi-section-table-row">
+                                       <td style="text-align:left">&#160;</td>
+                                       <td style="text-align:left"><em><%:none%></em></td>
+                                       <td style="text-align:left"><em><%:none%></em></td>
+                                       <td style="text-align:right"><em><%:none%></em></td>
+                                       <td style="text-align:left"><em><%:none%></em></td>
+                               </tr>
+                               <% end %>
+                       </table>
+               <% if not querypat then %>
+                       </div>
                <% end %>
-       </div>
-</form>
+               </fieldset>
+       <% end %>
+</div>
+
 <%+footer%>