luci/applications/luci-app-lxc/htdocs/luci-static/resources/view, branch master

luci-app-lxc: build container rows with E() instead of HTML strings

2026-07-20T19:40:29Z

CSP nonce policies block inline event attributes (onclick, onchange) even when script-src is nonce-gated. The dynamically created container rows relied on such attributes assembled through innerHTML string concatenation, which also interpolated the container name and the raw container configuration into markup unescaped - a literal "" inside a container config would break out of the configuration editor. Rebuild the rows and the configuration editor with E(), attaching the click/change listeners directly (matching the idiom already used throughout luci-app-package-manager, luci-app-upnp, etc: a function value on an E() attribute becomes an addEventListener call, and ev.target reads back the data-* attributes) and passing the container name and configuration contents as text nodes instead of interpolated markup. Remove the window.* handler exports that existed only to make the handlers reachable from inline attributes. Signed-off-by: Maxim Skokov

luci-app-lxc: fix stale sibling check in action_more_handler

2026-07-20T19:36:17Z

element.dataset never returns null (only a string when the attribute is present, or undefined otherwise), so "next_div.dataset['action'] !== null" was always true. Clicking "configure" therefore removed the next sibling row unconditionally, even when it belonged to a different, unrelated container rather than a previously-opened configuration panel (which is what the check was meant to detect via the data-action marker set a few lines below). Compare against undefined instead so the removal only fires when the next sibling is actually the marked configuration panel. Signed-off-by: Maxim Skokov

luci-app-lxc: convert to JS

2026-02-19T01:00:14Z

migrate away from the old luci-app lua control system. See: https://github.com/openwrt/luci/issues/7310 Signed-off-by: Paul Donald