From bfc98bec4d79efb24434e11ea27b3c17c31365ab Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jo@mein.io>
Date: Thu, 5 Apr 2018 23:00:46 +0200
Subject: [PATCH] luci-mod-admin-full: escape display parameter

Prevent reflected XSS through the reset button by url encoding the
display parameter.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
---
 modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm b/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm
index d5d78289b..88e0fffd9 100644
--- a/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm
+++ b/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm
@@ -69,7 +69,7 @@ end
 				<% if querypat then %>
 				<div class="cbi-value">
 					<%:Displaying only packages containing%> <strong>"<%=pcdata(query)%>"</strong>
-					<input type="button" onclick="location.href='?display=<%=pcdata(display)%>'" href="#" class="cbi-button cbi-button-reset" style="margin-left:1em" value="<%:Reset%>" />
+					<input type="button" onclick="location.href='?display=<%=luci.http.urlencode(display)%>'" href="#" class="cbi-button cbi-button-reset" style="margin-left:1em" value="<%:Reset%>" />
 					<br style="clear:both" />
 				</div>
 				<% end %>
-- 
2.11.0