Skip to content

Commit 8575c54

Browse files
Ananth916roushan-telMonekaLakshmiNithishkumar-Tanoopchelakkode
authored
Rebase with Develop (#85)
* XER10-1896: Adding regex to validate client hostname (#76) * XER10-1896: Adding regex to validate client hostname XER10-1896: Adding regex to validate client hostname Reason for change: GUI throws 500 Internal Server Error or logs out from UI when clicking on Connected Devices Test Procedure: Build and verify in GUI page Risks: Low Priority: P2 * XER10-1896: Adding regex to validate client hostname XER10-1896: Adding regex to validate client hostname Reason for change: GUI throws 500 Internal Server Error or logs out from UI when clicking on Connected Devices Test Procedure: Build and verify in GUI page Risks: Low Priority: P2 * XER10-1896: Adding regex to validate client hostname XER10-1896: Adding regex to validate client hostname Reason for change: GUI throws 500 Internal Server Error or logs out from UI when clicking on Connected Devices Test Procedure: Build and verify in GUI page Risks: Low Priority: P2 * RDKB-61349: [SECVULN] Issuer and audience validation missing (#65) * RDKB-61349: [SECVULN] Issuer and audience validation missing Reason for change: Added validation check * RDKB-61349: Update jwt.jst * RDKB-61349: Update jwt.jst Reason for change: Addressed iss and aud validation logic * RDKB-61349: Update jwt.jst * RDKB-61349 : Update jwt.jst * RDKB-61349: Update jwt.jst * RDKB-61349: Update jwt.jst * RDKB-61349: Update jwt.jst * Add changelog for release 1.4.0 * RDKB-62532: Removing 400ns Guard Interval for 11ax/be for WiFi standards (#77) RDKB-62532: Removing 400ns Guard Interval for 11ax/be for WiFi standards Reason for change: 400ns Guard Interval is not applicable for 11ax/be Test Procedure: Build and verify in MSO page Risks: Low Priority: P1 Co-authored-by: anoopchelakkode <65686868+anoopchelakkode@users.noreply.github.com> * RDKBDEV-3296: Xfinity Connection status page returns error 404 Not Found (#49) Reason for change: webui connection status page returns error Test Procedure: login to webui and open connection status page Risks: None Signed-off-by: sai satish kotapati <skotapati@maxlinear.com> Co-authored-by: Sukanya673 <60687655+Sukanya673@users.noreply.github.com> Co-authored-by: anoopchelakkode <65686868+anoopchelakkode@users.noreply.github.com> * RDKB-62740: Disable 320MHz for 11ax mode ion 6GHz (#83) RDKB-62740: Disable 320MHz for 11ax mode ion 6GHz Reason for change: 320MHz not supported for 11ax mode in 6GHz Test Procedure: Build and verify in MSO page Risks: Low Priority: P1 --------- Signed-off-by: sai satish kotapati <skotapati@maxlinear.com> Co-authored-by: roushan-tel <roushan.s@tataelxsi.co.in> Co-authored-by: MonekaLakshmi <101797473+MonekaLakshmi@users.noreply.github.com> Co-authored-by: Nithishkumar-T <109725053+Nithishkumar-T@users.noreply.github.com> Co-authored-by: anoopchelakkode <65686868+anoopchelakkode@users.noreply.github.com> Co-authored-by: satish-kotapati <skotapati@maxlinear.com> Co-authored-by: Sukanya673 <60687655+Sukanya673@users.noreply.github.com>
1 parent 8ef5563 commit 8575c54

File tree

6 files changed

+136
-49
lines changed

6 files changed

+136
-49
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,24 @@ All notable changes to this project will be documented in this file. Dates are d
44

55
Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
66

7+
#### [1.4.0](https://github.com/rdkcentral/webui/compare/1.3.0...1.4.0)
8+
9+
- RDKB-61349: [SECVULN] Issuer and audience validation missing [`#65`](https://github.com/rdkcentral/webui/pull/65)
10+
- XER10-1896: Adding regex to validate client hostname [`#76`](https://github.com/rdkcentral/webui/pull/76)
11+
- Merge tag '1.3.0' into develop [`1547fb9`](https://github.com/rdkcentral/webui/commit/1547fb9941bcb1c50feb2cb83a36afa0c47eda8f)
12+
713
#### [1.3.0](https://github.com/rdkcentral/webui/compare/1.2.1...1.3.0)
814

15+
> 6 November 2025
16+
917
- RDKB-61788 : Input elements blocked in WebUI can be bypassed in HCM mode [`#40`](https://github.com/rdkcentral/webui/pull/40)
1018
- RDKB-61758: Removed MoCA option in GUI in bridge mode. [`#66`](https://github.com/rdkcentral/webui/pull/66)
1119
- RDKB-62246 : Harden WebUI Login - Exclude for sky partner [`#64`](https://github.com/rdkcentral/webui/pull/64)
1220
- RDKB-61875: 320MHz BW is not greyed out for ax mode in 6G [`#60`](https://github.com/rdkcentral/webui/pull/60)
1321
- RDKB-62077: Failed to add Parental Control Managed Service with Alway… [`#63`](https://github.com/rdkcentral/webui/pull/63)
1422
- RDKB-62246 : Harden WebUI Login - Exclude sky dev [`3640651`](https://github.com/rdkcentral/webui/commit/3640651507fcc6b59a0de629aac7a067151da825)
23+
- Add changelog for release [`6c027d8`](https://github.com/rdkcentral/webui/commit/6c027d8fbc9eb1949c0a89ea498cb0613caa59aa)
1524
- RDKB-62077: Failed to add Parental Control Managed Service with AlwaysBlock enabled [`aeee8d9`](https://github.com/rdkcentral/webui/commit/aeee8d90f5d68201cd96a8fe9172a96f3845c02d)
16-
- RDKB-61875: 320MHz BW is not grayed out for ax mode in 6G [`0295e22`](https://github.com/rdkcentral/webui/commit/0295e22210c281a7a7b453cd94e54f18f63d296e)
1725

1826
#### [1.2.1](https://github.com/rdkcentral/webui/compare/1.2.0...1.2.1)
1927

‎source/Styles/xb3/jst/connected_devices_computers.jst‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -204,10 +204,10 @@ if($locale=="it" || $locale=="en_GB"){
204204
$onlinePrivateNetworkHost[$j.toString()]={};
205205
$onlinePrivateNetworkHost[$j.toString()]['instanceID'] = $i + 1;
206206
array_push($onlinePrivateInstanceArr, $onlinePrivateNetworkHost[$j.toString()]['instanceID']);
207-
if (($Host[$i]['HostName'] == "*") || (strlen($Host[$i]['HostName']) == 0))
208-
$onlinePrivateNetworkHost[$j.toString()]['HostName'] = strtoupper($Host[$i.toString()]['PhysAddress']);
209-
else
210-
$onlinePrivateNetworkHost[$j.toString()]['HostName'] = $Host[$i.toString()]['HostName'];
207+
if ((strlen($Host[$i]['HostName']) != 0) && isValidHostname($Host[$i]['HostName']))
208+
$onlinePrivateNetworkHost[$j.toString()]['HostName'] = $Host[$i.toString()]['HostName'];
209+
else
210+
$onlinePrivateNetworkHost[$j.toString()]['HostName'] = strtoupper($Host[$i.toString()]['PhysAddress']);
211211
array_push($onlineHostNameArr, $onlinePrivateNetworkHost[$j.toString()]['HostName']);
212212
$onlinePrivateNetworkHost[$j.toString()]['IPv4Address'] = $Host[$i.toString()]['IPv4Address.1.IPAddress'];
213213
// IPV6 link-local address
@@ -236,10 +236,10 @@ if($locale=="it" || $locale=="en_GB"){
236236
$offlinePrivateNetworkHost[$k]={};
237237
$offlinePrivateNetworkHost[$k.toString()]['instanceID'] = $i + 1;
238238
array_push($offlinePrivateInstanceArr, $offlinePrivateNetworkHost[$k.toString()]['instanceID']);
239-
if (($Host[$i]['HostName'] == "*") || (strlen($Host[$i]['HostName']) == 0))
240-
$offlinePrivateNetworkHost[$k.toString()]['HostName'] = strtoupper($Host[$i.toString()]['PhysAddress']);
241-
else
242-
$offlinePrivateNetworkHost[$k.toString()]['HostName'] = $Host[$i.toString()]['HostName'];
239+
if ((strlen($Host[$i]['HostName']) != 0) && isValidHostname($Host[$i]['HostName']))
240+
$offlinePrivateNetworkHost[$k.toString()]['HostName'] = $Host[$i.toString()]['HostName'];
241+
else
242+
$offlinePrivateNetworkHost[$k.toString()]['HostName'] = strtoupper($Host[$i.toString()]['PhysAddress']);
243243
array_push($offlineHostNameArr, $offlinePrivateNetworkHost[$k.toString()]['HostName']);
244244
$offlinePrivateNetworkHost[$k.toString()]['IPv4Address'] = $Host[$i.toString()]['IPv4Address.1.IPAddress'];
245245
// IPV6 link-local address

‎source/Styles/xb3/jst/connection_status.jst‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -419,8 +419,10 @@ if(($allowEthWan=="true") || ($autoWanEnable=="true")) {
419419
echo('<span class="value" id="actethwan">Active Ethernet WAN');
420420
}else if(strtolower($selectedOperationalMode)=="docsis"){
421421
echo('<span class="value" id="actdocwan">Active Docsis WAN');
422-
}else{
422+
}else if($selectedOperationalMode == "auto"){
423423
echo('<span class="value" id="actautwan">Active Auto WAN');
424+
}else{
425+
echo('<span class="value" id="unknown">Unknown WAN');
424426
}
425427
}else{
426428
$wan_enable= getStr("Device.Ethernet.X_RDKCENTRAL-COM_WAN.Enabled");

‎source/Styles/xb3/jst/includes/jwt.jst‎

Lines changed: 81 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,59 @@ $JWTdir = "/tmp/.jwt/";
99
$PUBKEYFILE = $JWTdir + "pubkey.cer";
1010
$JWTkeyfile = $JWTdir + "keys";
1111
$KeyURL = "https://login.microsoftonline.com/906aefe9-76a7-4f65-b82d-5ec20775d5aa/discovery/v2.0/keys";
12+
$expected_issuer = "https://login.microsoftonline.com/" + $tid + "/v2.0";
13+
14+
function GetExpectedAud()
15+
{
16+
var file = "/etc/webui/aud.conf";
17+
18+
if (!file_exists(file)) {
19+
LogStr("aud.conf missing");
20+
return "";
21+
}
22+
23+
var lines = file_get_contents(file).split("\n");
24+
25+
var env = "prod";
26+
var expectedAud = "";
27+
var line, key, val, pos;
28+
29+
for (var i = 0; i < lines.length; i++) {
30+
line = lines[i];
31+
32+
pos = strpos(line, "=");
33+
if (pos <= 0) continue;
34+
35+
key = substr(line, 0, pos);
36+
val = substr(line, pos + 1);
37+
38+
if (key == "env") {
39+
env = val;
40+
break;
41+
}
42+
}
43+
44+
var audKey = "aud_" + env;
45+
for (var i = 0; i < lines.length; i++) {
46+
line = lines[i];
47+
48+
pos = strpos(line, "=");
49+
if (pos <= 0) continue;
50+
51+
key = substr(line, 0, pos);
52+
val = substr(line, pos + 1);
53+
54+
if (key == audKey) {
55+
expectedAud = val;
56+
break;
57+
}
58+
}
59+
if (expectedAud == "") {
60+
LogStr("No AUD for " + audKey);
61+
return "";
62+
}
63+
return expectedAud;
64+
}
1265

1366
function VerifyToken($token)
1467
{
@@ -26,16 +79,10 @@ function VerifyToken($token)
2679
if( $validtoken == true )
2780
{
2881
$decodeddata = base64decode_url( $tokensegs[1] );
29-
$decodeddata = trim( $decodeddata, "{}" );
30-
$decodeddata = str_replace( '{', '', $decodeddata);
31-
$decodeddata = str_replace( '}', '', $decodeddata);
32-
$decodeddata = $decodeddata.split('"').join('');
33-
$pair = explode( ',', $decodeddata );
34-
for ( $k in $pair ) {
35-
temp = $pair[$k];
36-
list = {};
37-
list = explode( ':', temp, 2 );
38-
$tokendata[list[0]] = list[1];
82+
$tokendata = json_decode($decodeddata, true);
83+
if ($tokendata === null) {
84+
LogStr("ERROR: Failed to decode JWT payload JSON");
85+
return false;
3986
}
4087
$validtoken &= VerifyTokenData( $tokendata );
4188
}
@@ -155,19 +202,32 @@ function VerifyTokenData($tkdata)
155202
$tokennbf = parseInt( $tkdata['nbf'] );
156203
$tokenexp = parseInt( $tkdata['exp'] );
157204

158-
if( ($curtime < $tokenexp) // current time must be < expiration
159-
&& ($curtime >= $tokennbf) // current time must be >= not before time
160-
&& ($curtime >= $tokeniat) ) // current time must be >= issued at time
205+
$skew = 120; // 2-minute drift tolerance
206+
207+
if( ($curtime < ($tokenexp + $skew))
208+
&& ($curtime >= ($tokennbf - $skew))
209+
&& ($curtime >= ($tokeniat - $skew)) )
161210
{
162-
if( $tkdata['tid'] == $tid )
211+
// Tenant validation
212+
if( $tkdata['tid'] != $tid )
163213
{
164-
$retval = true;
214+
LogStr(" : Error: Token fails Tenant ID ");
215+
return false;
165216
}
166-
else
217+
// Issuer validation
218+
if( !isset($tkdata['iss']) || $tkdata['iss'] != $expected_issuer )
219+
{
220+
LogStr(" : Error: Token fails issuer validation ");
221+
return false;
222+
}
223+
// Audience validation
224+
$expected_aud = GetExpectedAud();
225+
if( !isset($tkdata['aud']) || $tkdata['aud'] != $expected_aud )
167226
{
168-
$errstr = " : Error: Token fails Tenant ID, tid=" + $tkdata['tid'];
169-
LogStr( $errstr );
227+
LogStr(" : Error: Token fails audience validation");
228+
return false;
170229
}
230+
$retval = true;
171231
}
172232
else
173233
{
@@ -248,10 +308,9 @@ function LogBeginLoginAttempt()
248308
function LogTokenData($tkdata)
249309
{
250310

251-
$email = SHA256($tkdata['email']);
252-
$strhex = asc2hex($email);
253-
$str = " : OAUTH userId=" + $strhex;
254-
$str = $str + " JWT expiration=" + $tkdata['exp'] ;
311+
$objId = SHA256($tkdata['oid']);
312+
$strhex = asc2hex($objId);
313+
$str = " : OAUTH objectId=" + $objId + " JWT expiration=" + $tkdata['exp'];
255314

256315
LogStr( $str );
257316
}

‎source/Styles/xb3/jst/includes/utility.jst‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1237,20 +1237,18 @@ function current_operationalMode()
12371237
$selectedOperationalMode=getStr("Device.X_RDKCENTRAL-COM_EthernetWAN.SelectedOperationalMode");
12381238
}
12391239
else{
1240-
if(is_docsis_supported()) {
1241-
$docsisEnable =getStr("Device.X_RDK_WanManager.Interface.1.Selection.Enable");
1242-
$ethernetEnable =getStr("Device.X_RDK_WanManager.Interface.2.Selection.Enable");
1243-
} else {
1244-
$ethernetEnable = getStr("Device.X_RDK_WanManager.Interface.1.Selection.Enable");
1245-
$docsisEnable = "false";
1246-
}
1247-
1248-
if(($ethernetEnable=="true") && ($docsisEnable=="false")){
1249-
$selectedOperationalMode="Ethernet";
1250-
}else if(($ethernetEnable=="false") && ($docsisEnable=="true")){
1251-
$selectedOperationalMode="DOCSIS";
1252-
}else if(($ethernetEnable=="true") && ($docsisEnable=="true")){
1253-
$selectedOperationalMode="Auto";
1240+
$selectedOperationalMode = getStr("Device.X_RDK_WanManager.InterfaceAvailableStatus");
1241+
if ($selectedOperationalMode == "") {
1242+
$selectedOperationalMode = "unknown";
1243+
}
1244+
else if ($selectedOperationalMode.includes("|")) {
1245+
//If more than a single WAN is configured
1246+
$selectedOperationalMode = "auto";
1247+
}
1248+
else {
1249+
// Split the string by comma and extract the first part
1250+
$parts = $selectedOperationalMode.split(",");
1251+
$selectedOperationalMode = $parts[0];
12541252
}
12551253
}
12561254
return $selectedOperationalMode;
@@ -1278,4 +1276,14 @@ function get_dhcp_client_interfaces()
12781276
if($dhcp_client_interfaces.v6 == "") $dhcp_client_interfaces.v6 = "Device.DHCPv6.Client.1";
12791277
return $dhcp_client_interfaces;
12801278
}
1279+
1280+
/**
1281+
* Description:
1282+
* verifies the validity of client hostname
1283+
* return true if patten match otherwise false
1284+
*/
1285+
function isValidHostname(hostname) {
1286+
var $hostnameRegex = /^[a-zA-Z0-9_-]{1,30}$/;
1287+
return $hostnameRegex.test(hostname);
1288+
}
12811289
?>

‎source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -808,6 +808,13 @@ $(document).ready(function() {
808808
$("#operation_mode1").prop("disabled", true);
809809
}
810810
}).trigger("change");
811+
$("#wireless_mode3").change(function() {
812+
if ("ax"==$("#wireless_mode3").val()) {
813+
$("#channel_bandwidth7").prop("disabled", true);
814+
} else if("ax,be"==$("#wireless_mode3").val() || "be"==$("#wireless_mode3").val()) {
815+
$("#channel_bandwidth7").prop("disabled", false);
816+
}
817+
}).trigger("change");
811818
$("#channel_number").change(function() {
812819
show_extch(document.getElementById("channel_number").value);
813820
}).trigger("change");
@@ -1869,7 +1876,9 @@ if($OperatingChannelBandwidth == "6GHz")
18691876
</div>
18701877
<div class="form-row">
18711878
<label for="guard_interval800ns" id="wiremess19">Guard Interval:</label>
1872-
<input type="radio" name="guard_interval" value="400nsec" id="guard_interval800ns" checked="checked" /><b>400ns</b>
1879+
<?% if ("g,n" == $wireless_mode) { ?>
1880+
<input type="radio" name="guard_interval" value="400nsec" id="guard_interval800ns" checked="checked" /><b>400ns</b>
1881+
<?% } ?>
18731882
<label for="guard_interval400ns" class="acs-hide"></label>
18741883
<input type="radio" name="guard_interval" value="800nsec" id="guard_interval400ns" <?% if ("800nsec"==$guard_interval) echo( 'checked="checked"');?> /><b>800ns</b>
18751884
<?% if (strstr($support_mode, "be")){ ?>
@@ -2121,7 +2130,9 @@ if($OperatingChannelBandwidth == "6GHz")
21212130
</div>
21222131
<div class="form-row odd">
21232132
<label for="guard_interval800ns1" id="wiremess19">Guard Interval:</label>
2124-
<input type="radio" name="guard_interval1" value="400nsec" id="guard_interval800ns1" checked="checked" /><b>400ns</b>
2133+
<?% if ("a,n" == $wireless_mode1 || "a,n,ac" == $wireless_mode1) { ?>
2134+
<input type="radio" name="guard_interval1" value="400nsec" id="guard_interval800ns1" checked="checked" /><b>400ns</b>
2135+
<?% } ?>
21252136
<label for="guard_interval400ns1" class="acs-hide"></label>
21262137
<input type="radio" name="guard_interval1" value="800nsec" id="guard_interval400ns1" <?% if ("800nsec"==$guard_interval1) echo('checked="checked"');?> /><b>800ns</b>
21272138
<?% if (strstr($support_mode_5g, "be")){ ?>
@@ -2314,7 +2325,6 @@ if($OperatingChannelBandwidth == "6GHz")
23142325
</div>
23152326
<div class="form-row odd">
23162327
<label for="guard_interval800ns1" id="wiremess19">Guard Interval:</label>
2317-
<input type="radio" name="guard_interval3" value="400nsec" id="guard_interval800ns1" checked="checked" /><b>400ns</b>
23182328
<label for="guard_interval400ns1" class="acs-hide"></label>
23192329
<input type="radio" name="guard_interval3" value="800nsec" id="guard_interval400ns1" <?% if ("800nsec"==$guard_interval3) echo('checked="checked"');?> /><b>800ns</b>
23202330
<?% if (strstr($support_mode_6g, "be")){ ?>

0 commit comments

Comments
 (0)