* luci/libs: use striptags() in cbi <option> elements

diff --git a/libs/cbi/luasrc/cbi.lua b/libs/cbi/luasrc/cbi.lua
index 48a91d3b5a3bfa79dc402feeec1b7c2ae8390dbb..295998e924a2e48609121da162c7fccf95987e42 100644 (file)
--- a/libs/cbi/luasrc/cbi.lua
+++ b/libs/cbi/luasrc/cbi.lua
@@ -783,8 +783,9 @@ end
 function AbstractValue.render(self, s, scope)
        if not self.optional or self:cfgvalue(s) or self:formcreated(s) then
                scope = scope or {}
-               scope.section = s
-               scope.cbid    = self:cbid(s)
+               scope.section   = s
+               scope.cbid      = self:cbid(s)
+               scope.striptags = luci.util.striptags
 
                scope.ifattr = function(cond,key,val)
                        if cond then

diff --git a/libs/cbi/luasrc/view/cbi/lvalue.htm b/libs/cbi/luasrc/view/cbi/lvalue.htm
index 60dd682808acd2b1dcb00ef4d8f0b3697e0e1f27..92f021e0639314b4d970df74388685e0195f8bdd 100644 (file)
--- a/libs/cbi/luasrc/view/cbi/lvalue.htm
+++ b/libs/cbi/luasrc/view/cbi/lvalue.htm
@@ -16,7 +16,7 @@ $Id$
 <% if self.widget == "select" then %>
        <select onchange="cbi_d_update(this.id)"<%= attr("id", cbid) .. attr("name", cbid) .. ifattr(self.size, "size") %>>
        <% for i, key in pairs(self.keylist) do -%>
-               <option id="cbi-<%=self.config.."-"..section.."-"..self.option.."-"..key%>"<%= attr("value", key) .. ifattr(self:cfgvalue(section) == key, "selected", "selected") %>><%=luci.util.pcdata(self.vallist[i])%></option>
+               <option id="cbi-<%=self.config.."-"..section.."-"..self.option.."-"..key%>"<%= attr("value", key) .. ifattr(self:cfgvalue(section) == key, "selected", "selected") %>><%=striptags(self.vallist[i])%></option>
        <%- end %>
        </select>
 <% elseif self.widget == "radio" then

diff --git a/libs/cbi/luasrc/view/cbi/mvalue.htm b/libs/cbi/luasrc/view/cbi/mvalue.htm
index f53660824de9ed7cdf5bb1872e7ca666dd433858..4b69708ecd4f3d82aa035816cc122aa657e47a51 100644 (file)
--- a/libs/cbi/luasrc/view/cbi/mvalue.htm
+++ b/libs/cbi/luasrc/view/cbi/mvalue.htm
@@ -19,7 +19,7 @@ local v = self:valuelist(section)
 <% if self.widget == "select" then %>
        <select multiple="multiple"<%= attr("name", cbid) .. ifattr(self.size, "size") %>>
        <% for i, key in pairs(self.keylist) do -%>
-               <option<%= attr("value", key) .. ifattr(luci.util.contains(v, key), "selected", "selected") %>><%=self.vallist[i]%></option>
+               <option<%= attr("value", key) .. ifattr(luci.util.contains(v, key), "selected", "selected") %>><%=striptags(self.vallist[i])%></option>
        <%- end %>
        </select>
 <% elseif self.widget == "checkbox" then

diff --git a/libs/cbi/luasrc/view/cbi/ucisection.htm b/libs/cbi/luasrc/view/cbi/ucisection.htm
index f8cf3d1bc0ba780f8a0f22b79f3310cfac8fe093..1d318f7915db52849b71b21b11a9035ac034f2ad 100644 (file)
--- a/libs/cbi/luasrc/view/cbi/ucisection.htm
+++ b/libs/cbi/luasrc/view/cbi/ucisection.htm
@@ -23,7 +23,7 @@ $Id$
                <select name="cbi.opt.<%=self.config%>.<%=section%>">
                        <option><%:cbi_addopt%></option>
                        <% for key, val in pairs(self.optionals[section]) do -%>
-                               <option id="cbi-<%=self.config.."-"..section.."-"..val.option%>" value="<%=val.option%>"><%=val.title%></option>
+                               <option id="cbi-<%=self.config.."-"..section.."-"..val.option%>" value="<%=val.option%>"><%=striptags(val.title)%></option>
                        <%- end %>
                </select>
                <script type="text/javascript"><% for key, val in pairs(self.optionals[section]) do %>