luci/modules/luci-mod-status/htdocs/luci-static/resources, branch master

treewide: wrap loose view content in cbi-section

2026-09-06T18:47:04Z

Views that returned headings, tables and control rows with nothing around them now wrap that content in a section: the system and kernel logs, Processes, the nftables and iptables views, Startup, the wireless station list, DSL stats and the package manager. The nftables rule tables also drop an !important that no theme could override. Nothing changes in the stock bootstrap theme; themes that draw .cbi-section as a panel get the structure they need. Signed-off-by: Ivan Kvashonkin

treewide: fix textarea double scrolling issue

2026-09-05T15:16:34Z

In "textarea" class elements, like the syslog, depending on the browser, it is difficult to scroll if moused over or after clicking or highlighting text. The browser perceives that there is scrolling space/content within the inner element because when the height of the element is exactly the same size as text inside, the text padding or other invisible content exceeds the size of the text box and the scroll bar is kept in the window. This causes scrolling within the element with a range of just a few pixels, and the rest of the page remains static and refuses to scroll. To fix this add 1 to the dynamic size of the "textarea" boxes, and also the initial values before the dynamic size is calculated. This "+ 1" already exists in some instances of similar Javascript files. A previous attempt at fixing this used "overflow-y" styling but that causes undesirable behavior in some "textarea" use cases. In some cases "+ 1" is added to both dynamic and final sizes, this can equate to a total addition of 2 lines, which is still reasonable and proper padding, and this promotes the habit of padding the textarea elements treewide, no matter what example is used to modify or create the javascript for a new app. The aria2 application ternary check for a minimum textarea size seems to be written in reversed logic. It should likely be a minimum of 20 lines, and the exact number + 1 otherwise, so fix that while at it. Tested on Chrome 64-bit Windows 10. Ref: 755061bc9e7e ("themes: remove overflow-y property...") Signed-off-by: Michael Pratt

luci-mod-status: add button role on HIDE buttons

2026-08-03T13:04:49Z

This change helps to identify the HIDE span elements as clickable buttons for screen readers. Before this change it was not obvious that the sections on the status panel can be hidden, and clean interfaces are key for easy screen reader navigation. Signed-off-by: Bendeguz Pisch

luci-mod-status: escape target/iface names in iptables status view

2026-07-20T19:37:52Z

current_rules entries for target, indev and outdev were interpolated into raw HTML strings via '%s'.format(), causing the values to be assigned through innerHTML when rendered by cbi_update_table(). Both fields ultimately originate from iptables -L output and are not fully sanitized upstream, so a crafted chain or interface name could inject markup into the status page. Replace the HTML string interpolation with E('span', ...) which appends the value via createTextNode() instead of innerHTML, matching the idiomatic pattern already used for ifacebadge spans elsewhere in the codebase (routes.js, routesj.js, wireless.js). Related to the discussion in #8749 about making cell values passed to cbi_update_table() safe by default. Signed-off-by: Maxim Skokov

luci-mod-status: guard against null l3 device in addDhcpv6Stats

2026-07-20T19:35:11Z

addDhcpv6Stats() accesses dev.device without checking if dev is null. getL3Device() returns null when a dhcpv6 interface is configured but not yet up, causing a crash when rendering the network status box. Add a dev null check before accessing dev.device. Signed-off-by: Maxim Skokov

treewide: escape slash chars in regex strings in .js files

2026-06-25T20:14:58Z

Properly escape the slash '/' chars that are included in the regex strings in javascript files. Slash is used as a regex delimiter in javascript, so an un-escaped slash may cause parsing errors in some tools like xgettext used with .po translation manipulation. Signed-off-by: Hannu Nyman

luci-mod-status: escape hostname in DHCP lease status tables

2026-06-22T22:15:31Z

Avoid stored XSS by HTML escaping backend provided hostname since underlying services to not sanitize. Signed-off-by: Jo-Philipp Wich

luci-mod-status: resolve named counters in nftables view

2026-06-22T19:42:33Z

The nftables status view rendered the byte/packet badge by reading .bytes/.packets directly off a rule's counter statement. That only holds for anonymous (inline) counters, whose JSON statement is an object. Named counter objects (counter name "") are serialized as a bare name string instead, so .bytes was undefined and the badge showed "undefinedB". Named counters are used in banIP for example. Resolve named counter references against the standalone counter objects of the same family and table before rendering, and skip the badge when a reference cannot be resolved instead of emitting garbage. While at it, replace some withespaces with tabs. Signed-off-by: Dirk Brenken

luci-mod-status: correctness fixes

2026-05-27T12:49:46Z

Signed-off-by: Paul Donald

luci-mod: use built-in format for wifi hostname

2026-04-20T12:46:13Z

Signed-off-by: Paul Donald