Skip to content

MESH-API v0.7.5.2 Beta - Hotfix for Broken Dashboard

Choose a tag to compare

View all tags
@mr-tbot mr-tbot released this 19 Jul 04:24
· 1 commit to main since this release
v0.7.5.2-beta
4d1c085

MESH-API v0.7.5.2 Beta - Hotfix for Broken Dashboard in v0.7.5.0 / v0.7.5.1

A hotfix. Releases v0.7.5.0 and v0.7.5.1 shipped a bug that broke the web
dashboard - please update to v0.7.5.2.

What was broken

The v0.7.5.0 Node Map XSS-hardening introduced a Python string-escaping mistake:
the source /\\/g was processed by Python into /\/g in the served JavaScript,
which is an invalid regular expression. That threw a SyntaxError that aborted the
entire dashboard <script> block, so the Node Map, Traffic Monitor, and
Available Nodes list all failed to render. It looked like nodes were not
connecting, but the backend (Meshtastic/MeshCore connection, /nodes, /api/traffic)
was fine the whole time - only the front-end JavaScript was crashing.

The fix

The Node Map popup button handlers now build their arguments with
escapeHtml(JSON.stringify(...)), which is correct in both the JS-string and the
HTML-attribute context and contains no backslash literals for Python to mangle.
The served dashboard JavaScript is now validated to parse cleanly.

If you installed v0.7.5.0 or v0.7.5.1, update to v0.7.5.2 (or docker pull mrtbot/mesh-api:latest) and hard-refresh the dashboard.

Still a beta - please report anything that breaks on GitHub Issues.

Assets 2
Loading