Skip to content

Commit 2084a81

Browse files
samrocketmanrwillert
samrocketman
and
rwillert
committed
Fix PreUp, PostUp, PreDown, and PostDown
* Escaping HTML in several places. * Adds PreUp config when one didn't exist. * Adds environment variable support for PreUp and PreDown. closes ngoduykhanh#549 closes ngoduykhanh#655 closes ngoduykhanh#656 See also -------- - samrocketman/addons-homeassistant#9 Co-authored-by: Robert Willert <[email protected]>
1 parent 2fdafd3 commit 2084a81

File tree

10 files changed

+55
-22
lines changed

10 files changed

+55
-22
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,9 @@ These environment variables are used to control the default server settings used
8383
|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------|
8484
| `WGUI_SERVER_INTERFACE_ADDRESSES` | The default interface addresses (comma-separated-list) for the WireGuard server configuration | `10.252.1.0/24` |
8585
| `WGUI_SERVER_LISTEN_PORT` | The default server listen port | `51820` |
86+
| `WGUI_SERVER_PRE_UP_SCRIPT` | The default server pre-up script | N/A |
8687
| `WGUI_SERVER_POST_UP_SCRIPT` | The default server post-up script | N/A |
88+
| `WGUI_SERVER_PRE_DOWN_SCRIPT` | The default server pre-down script | N/A |
8789
| `WGUI_SERVER_POST_DOWN_SCRIPT` | The default server post-down script | N/A |
8890

8991
### Defaults for new clients

‎custom/js/helper.js‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
/*
2+
Hack using jQuery's text() method and a temporary element to escape html()
3+
utilizing jQuery.
4+
*/
5+
function escapeHtml(unsafe) {
6+
return $('<div/>').text(unsafe).html();
7+
}
18
function renderClientList(data) {
29
$.each(data, function(index, obj) {
310
// render telegram button
@@ -6,13 +13,13 @@ function renderClientList(data) {
613
telegramButton = `<div class="btn-group">
714
<button type="button" class="btn btn-outline-primary btn-sm" data-toggle="modal"
815
data-target="#modal_telegram_client" data-clientid="${obj.Client.id}"
9-
data-clientname="${obj.Client.name}">Telegram</button>
16+
data-clientname="${escapeHtml(obj.Client.name)}">Telegram</button>
1017
</div>`
1118
}
1219

1320
let telegramHtml = "";
1421
if (obj.Client.telegram_userid && obj.Client.telegram_userid.length > 0) {
15-
telegramHtml = `<span class="info-box-text" style="display: none"><i class="fas fa-tguserid"></i>${obj.Client.telegram_userid}</span>`
22+
telegramHtml = `<span class="info-box-text" style="display: none"><i class="fas fa-tguserid"></i>${escapeHtml(obj.Client.telegram_userid)}</span>`
1623
}
1724

1825
// render client status css tag style
@@ -24,13 +31,13 @@ function renderClientList(data) {
2431
// render client allocated ip addresses
2532
let allocatedIpsHtml = "";
2633
$.each(obj.Client.allocated_ips, function(index, obj) {
27-
allocatedIpsHtml += `<small class="badge badge-secondary">${obj}</small>&nbsp;`;
34+
allocatedIpsHtml += `<small class="badge badge-secondary">${escapeHtml(obj)}</small>&nbsp;`;
2835
})
2936

3037
// render client allowed ip addresses
3138
let allowedIpsHtml = "";
3239
$.each(obj.Client.allowed_ips, function(index, obj) {
33-
allowedIpsHtml += `<small class="badge badge-secondary">${obj}</small>&nbsp;`;
40+
allowedIpsHtml += `<small class="badge badge-secondary">${escapeHtml(obj)}</small>&nbsp;`;
3441
})
3542

3643
let subnetRangesString = "";
@@ -40,7 +47,7 @@ function renderClientList(data) {
4047

4148
let additionalNotesHtml = "";
4249
if (obj.Client.additional_notes && obj.Client.additional_notes.length > 0) {
43-
additionalNotesHtml = `<span class="info-box-text" style="display: none"><i class="fas fa-additional_notes"></i>${obj.Client.additional_notes.toUpperCase()}</span>`
50+
additionalNotesHtml = `<span class="info-box-text" style="display: none"><i class="fas fa-additional_notes"></i>${escapeHtml(obj.Client.additional_notes.toUpperCase())}</span>`
4451
}
4552

4653
// render client html content
@@ -56,12 +63,12 @@ function renderClientList(data) {
5663
<div class="btn-group">
5764
<button type="button" class="btn btn-outline-primary btn-sm" data-toggle="modal"
5865
data-target="#modal_qr_client" data-clientid="${obj.Client.id}"
59-
data-clientname="${obj.Client.name}" ${obj.QRCode != "" ? '' : ' disabled'}>QR code</button>
66+
data-clientname="${escapeHtml(obj.Client.name)}" ${obj.QRCode != "" ? '' : ' disabled'}>QR code</button>
6067
</div>
6168
<div class="btn-group">
6269
<button type="button" class="btn btn-outline-primary btn-sm" data-toggle="modal"
6370
data-target="#modal_email_client" data-clientid="${obj.Client.id}"
64-
data-clientname="${obj.Client.name}">Email</button>
71+
data-clientname="${escapeHtml(obj.Client.name)}">Email</button>
6572
</div>
6673
${telegramButton}
6774
<div class="btn-group">
@@ -72,30 +79,30 @@ function renderClientList(data) {
7279
<div class="dropdown-menu" role="menu">
7380
<a class="dropdown-item" href="#" data-toggle="modal"
7481
data-target="#modal_edit_client" data-clientid="${obj.Client.id}"
75-
data-clientname="${obj.Client.name}">Edit</a>
82+
data-clientname="${escapeHtml(obj.Client.name)}">Edit</a>
7683
<a class="dropdown-item" href="#" data-toggle="modal"
7784
data-target="#modal_pause_client" data-clientid="${obj.Client.id}"
78-
data-clientname="${obj.Client.name}">Disable</a>
85+
data-clientname="${escapeHtml(obj.Client.name)}">Disable</a>
7986
<a class="dropdown-item" href="#" data-toggle="modal"
8087
data-target="#modal_remove_client" data-clientid="${obj.Client.id}"
81-
data-clientname="${obj.Client.name}">Delete</a>
88+
data-clientname="${escapeHtml(obj.Client.name)}">Delete</a>
8289
</div>
8390
</div>
8491
<hr>
85-
<span class="info-box-text"><i class="fas fa-user"></i> ${obj.Client.name}</span>
86-
<span class="info-box-text" style="display: none"><i class="fas fa-key"></i> ${obj.Client.public_key}</span>
87-
<span class="info-box-text" style="display: none"><i class="fas fa-subnetrange"></i>${subnetRangesString}</span>
92+
<span class="info-box-text"><i class="fas fa-user"></i> ${escapeHtml(obj.Client.name)}</span>
93+
<span class="info-box-text" style="display: none"><i class="fas fa-key"></i> ${escapeHtml(obj.Client.public_key)}</span>
94+
<span class="info-box-text" style="display: none"><i class="fas fa-subnetrange"></i>${escapeHtml(subnetRangesString)}</span>
8895
${telegramHtml}
8996
${additionalNotesHtml}
90-
<span class="info-box-text"><i class="fas fa-envelope"></i> ${obj.Client.email}</span>
97+
<span class="info-box-text"><i class="fas fa-envelope"></i> ${escapeHtml(obj.Client.email)}</span>
9198
<span class="info-box-text"><i class="fas fa-clock"></i>
9299
${prettyDateTime(obj.Client.created_at)}</span>
93100
<span class="info-box-text"><i class="fas fa-history"></i>
94101
${prettyDateTime(obj.Client.updated_at)}</span>
95102
<span class="info-box-text"><i class="fas fa-server" style="${obj.Client.use_server_dns ? "opacity: 1.0" : "opacity: 0.5"}"></i>
96103
${obj.Client.use_server_dns ? 'DNS enabled' : 'DNS disabled'}</span>
97104
<span class="info-box-text"><i class="fas fa-file"></i>
98-
${obj.Client.additional_notes}</span>
105+
${escapeHtml(obj.Client.additional_notes)}</span>
99106
<span class="info-box-text"><strong>IP Allocation</strong></span>`
100107
+ allocatedIpsHtml
101108
+ `<span class="info-box-text"><strong>Allowed IPs</strong></span>`

‎model/server.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ type ServerInterface struct {
2222
Addresses []string `json:"addresses"`
2323
ListenPort int `json:"listen_port,string"` // ,string to get listen_port string input as int
2424
UpdatedAt time.Time `json:"updated_at"`
25+
PreUp string `json:"pre_up"`
2526
PostUp string `json:"post_up"`
2627
PreDown string `json:"pre_down"`
2728
PostDown string `json:"post_down"`

‎router/router.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,10 @@ func New(tmplDir fs.FS, extraData map[string]interface{}, secret [64]byte) *echo
112112
}
113113

114114
// create template list
115+
//"htmlescaper": template.htmlEscaper,
115116
funcs := template.FuncMap{
116117
"StringsJoin": strings.Join,
118+
"attrescaper": util.EscapeHtmlCode,
117119
}
118120
templates := make(map[string]*template.Template)
119121
templates["login.html"] = template.Must(template.New("login").Funcs(funcs).Parse(tmplLoginString))

‎store/jsondb/jsondb.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,9 @@ func (o *JsonDB) Init() error {
6464
serverInterface := new(model.ServerInterface)
6565
serverInterface.Addresses = util.LookupEnvOrStrings(util.ServerAddressesEnvVar, []string{util.DefaultServerAddress})
6666
serverInterface.ListenPort = util.LookupEnvOrInt(util.ServerListenPortEnvVar, util.DefaultServerPort)
67+
serverInterface.PreUp = util.LookupEnvOrString(util.ServerPreUpScriptEnvVar, "")
6768
serverInterface.PostUp = util.LookupEnvOrString(util.ServerPostUpScriptEnvVar, "")
69+
serverInterface.PreDown = util.LookupEnvOrString(util.ServerPreDownScriptEnvVar, "")
6870
serverInterface.PostDown = util.LookupEnvOrString(util.ServerPostDownScriptEnvVar, "")
6971
serverInterface.UpdatedAt = time.Now().UTC()
7072
o.conn.Write("server", "interfaces", serverInterface)

‎templates/server.html‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,21 +37,26 @@ <h3 class="card-title">Interface</h3>
3737
<input type="text" class="form-control" id="listen_port" name="listen_port"
3838
placeholder="Listen Port" value="{{ .serverInterface.ListenPort }}">
3939
</div>
40+
<div class="form-group">
41+
<label for="pre_up">Pre Up Script</label>
42+
<input type="text" class="form-control" id="pre_up" name="pre_up"
43+
placeholder="Pre Up Script" value="{{ .serverInterface.PreUp | attrescaper }}">
44+
</div>
4045
<div class="form-group">
4146
<label for="post_up">Post Up Script</label>
4247
<input type="text" class="form-control" id="post_up" name="post_up"
43-
placeholder="Post Up Script" value="{{ .serverInterface.PostUp }}">
48+
placeholder="Post Up Script" value="{{ .serverInterface.PostUp | attrescaper }}">
4449
</div>
4550
<div class="form-group">
4651
<label for="pre_down">Pre Down Script</label>
4752
<input type="text" class="form-control" id="pre_down" name="pre_down"
48-
placeholder="Pre Down Script" value="{{ .serverInterface.PreDown }}">
53+
placeholder="Pre Down Script" value="{{ .serverInterface.PreDown | attrescaper }}">
4954
</div>
5055

5156
<div class="form-group">
5257
<label for="post_down">Post Down Script</label>
5358
<input type="text" class="form-control" id="post_down" name="post_down"
54-
placeholder="Post Down Script" value="{{ .serverInterface.PostDown }}">
59+
placeholder="Post Down Script" value="{{ .serverInterface.PostDown | attrescaper }}">
5560
</div>
5661
</div>
5762
<!-- /.card-body -->
@@ -135,10 +140,11 @@ <h4 class="modal-title">KeyPair Generation</h4>
135140
function submitServerInterfaceSetting() {
136141
const addresses = $("#addresses").val().split(",");
137142
const listen_port = $("#listen_port").val();
143+
const pre_up = $("#pre_up").val();
138144
const post_up = $("#post_up").val();
139145
const pre_down = $("#pre_down").val();
140146
const post_down = $("#post_down").val();
141-
const data = {"addresses": addresses, "listen_port": listen_port, "post_up": post_up, "pre_down": pre_down, "post_down": post_down};
147+
const data = {"addresses": addresses, "listen_port": listen_port, "pre_up": pre_up, "post_up": post_up, "pre_down": pre_down, "post_down": post_down};
142148

143149
$.ajax({
144150
cache: false,

‎templates/wake_on_lan_hosts.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,15 +90,15 @@ <h4 class="modal-title">Remove</h4>
9090
<button type="button"
9191
class="btn btn-outline-primary btn-sm btn_modify_wake_on_lan_host"
9292
data-toggle="modal" data-target="#modal_wake_on_lan_host"
93-
data-name="{{ .Name }}" data-mac-address="{{ .MacAddress }}">Edit
93+
data-name="{{ .Name | attrescaper }}" data-mac-address="{{ .MacAddress }}">Edit
9494
</button>
9595
<button type="button" class="btn btn-outline-danger btn-sm" data-toggle="modal"
9696
data-target="#modal_remove_wake_on_lan_host"
9797
data-mac-address="{{ .MacAddress }}">Remove
9898
</button>
9999
</div>
100100
<hr>
101-
<span class="info-box-text"><i class="fas fa-address-card"></i> <span class="name">{{ .Name }}</span></span>
101+
<span class="info-box-text"><i class="fas fa-address-card"></i> <span class="name">{{ .Name | attrescaper }}</span></span>
102102
<span class="info-box-text"><i class="fas fa-ethernet"></i> <span class="mac-address">{{ .MacAddress }}</span></span>
103103
<span class="info-box-text"><i class="fas fa-clock"></i>
104104
<span class="latest-used">
@@ -120,4 +120,4 @@ <h4 class="modal-title">Remove</h4>
120120
{{end}}
121121
{{define "bottom_js"}}
122122
<script src="{{.basePath}}/static/custom/js/wake_on_lan_hosts.js"></script>
123-
{{end}}
123+
{{end}}

‎templates/wg.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ Address = {{$first :=true}}{{range .serverConfig.Interface.Addresses }}{{if $fir
88
ListenPort = {{ .serverConfig.Interface.ListenPort }}
99
PrivateKey = {{ .serverConfig.KeyPair.PrivateKey }}
1010
{{if .globalSettings.MTU}}MTU = {{ .globalSettings.MTU }}{{end}}
11+
PreUp = {{ .serverConfig.Interface.PreUp }}
1112
PostUp = {{ .serverConfig.Interface.PostUp }}
1213
PreDown = {{ .serverConfig.Interface.PreDown }}
1314
PostDown = {{ .serverConfig.Interface.PostDown }}

‎util/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,9 @@ const (
5858
LogLevel = "WGUI_LOG_LEVEL"
5959
ServerAddressesEnvVar = "WGUI_SERVER_INTERFACE_ADDRESSES"
6060
ServerListenPortEnvVar = "WGUI_SERVER_LISTEN_PORT"
61+
ServerPreUpScriptEnvVar = "WGUI_SERVER_PRE_UP_SCRIPT"
6162
ServerPostUpScriptEnvVar = "WGUI_SERVER_POST_UP_SCRIPT"
63+
ServerPreDownScriptEnvVar = "WGUI_SERVER_PRE_DOWN_SCRIPT"
6264
ServerPostDownScriptEnvVar = "WGUI_SERVER_POST_DOWN_SCRIPT"
6365
DefaultClientAllowedIpsEnvVar = "WGUI_DEFAULT_CLIENT_ALLOWED_IPS"
6466
DefaultClientExtraAllowedIpsEnvVar = "WGUI_DEFAULT_CLIENT_EXTRA_ALLOWED_IPS"

‎util/html.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
package util
2+
3+
import (
4+
"html"
5+
)
6+
7+
func EscapeHtmlCode(s string) string {
8+
encodedString := html.EscapeString(s)
9+
return encodedString
10+
}

0 commit comments

Comments
 (0)