luci/modules/luci-mod-status/htdocs, branch master

luci-mod-status: escape target/iface names in iptables status view

2026-07-20T19:37:52Z

current_rules entries for target, indev and outdev were interpolated into raw HTML strings via '%s'.format(), causing the values to be assigned through innerHTML when rendered by cbi_update_table(). Both fields ultimately originate from iptables -L output and are not fully sanitized upstream, so a crafted chain or interface name could inject markup into the status page. Replace the HTML string interpolation with E('span', ...) which appends the value via createTextNode() instead of innerHTML, matching the idiomatic pattern already used for ifacebadge spans elsewhere in the codebase (routes.js, routesj.js, wireless.js). Related to the discussion in #8749 about making cell values passed to cbi_update_table() safe by default. Signed-off-by: Maxim Skokov

luci-mod-status: guard against null l3 device in addDhcpv6Stats

2026-07-20T19:35:11Z

addDhcpv6Stats() accesses dev.device without checking if dev is null. getL3Device() returns null when a dhcpv6 interface is configured but not yet up, causing a crash when rendering the network status box. Add a dev null check before accessing dev.device. Signed-off-by: Maxim Skokov

treewide: escape slash chars in regex strings in .js files

2026-06-25T20:14:58Z

Properly escape the slash '/' chars that are included in the regex strings in javascript files. Slash is used as a regex delimiter in javascript, so an un-escaped slash may cause parsing errors in some tools like xgettext used with .po translation manipulation. Signed-off-by: Hannu Nyman

luci-mod-status: escape hostname in DHCP lease status tables

2026-06-22T22:15:31Z

Avoid stored XSS by HTML escaping backend provided hostname since underlying services to not sanitize. Signed-off-by: Jo-Philipp Wich

luci-mod-status: resolve named counters in nftables view

2026-06-22T19:42:33Z

The nftables status view rendered the byte/packet badge by reading .bytes/.packets directly off a rule's counter statement. That only holds for anonymous (inline) counters, whose JSON statement is an object. Named counter objects (counter name "") are serialized as a bare name string instead, so .bytes was undefined and the badge showed "undefinedB". Named counters are used in banIP for example. Resolve named counter references against the standalone counter objects of the same family and table before rendering, and skip the badge when a reference cannot be resolved instead of emitting garbage. While at it, replace some withespaces with tabs. Signed-off-by: Dirk Brenken

luci-mod-status: correctness fixes

2026-05-27T12:49:46Z

Signed-off-by: Paul Donald

luci-mod: use built-in format for wifi hostname

2026-04-20T12:46:13Z

Signed-off-by: Paul Donald

luci-mod-status: i18n string context

2026-04-16T14:10:18Z

i18n string context Signed-off-by: Andy Chiang

luci-mod-status: add null check

2026-02-19T00:16:35Z

follow-up to 95b01600e323f5cd0ac5081025dacd30110838c2 Port maps can sometimes lack mappings. Let's check. Signed-off-by: Paul Donald

luci-mod: js linting fixes / ES6 treatment

2026-02-16T00:42:57Z

Signed-off-by: Paul Donald