luci-mod-system: fix potential stored XSS

Make sure to escape the key contents in the delete confirmation dialog. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
openwrt · Jan 13, 2023 · 0186d7e · 0186d7e
1 parent 9634086
commit 0186d7e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
@@ -204,7 +204,7 @@ function removeKey(ev) {
 
 	L.showModal(_('Delete key'), [
 		E('div', _('Do you really want to delete the following SSH key?')),
-		E('pre', delkey),
+		E('pre', [ delkey ]),
 		E('div', { class: 'right' }, [
 			E('div', { class: 'btn', click: L.hideModal }, _('Cancel')),
 			' ',