From ade243f27f09e6c295cf232bd02bf85164820060 Mon Sep 17 00:00:00 2001
From: jjm2473 <jjm2473@gmail.com>
Date: Tue, 25 Mar 2025 20:16:55 +0800
Subject: [PATCH] Subject: [PATCH] Fix an XSS vulnerability

POC:
```
http://192.168.100.1/cgi-bin/luci//"><iframe src="javascript:alert(test)
```

fix https://github.com/jerrykuku/luci-theme-argon/issues/563

Signed-off-by: jjm2473 <jjm2473@gmail.com>
Signed-off-by: sbwml <admin@cooluc.com>
---
 luci-theme-argon/luasrc/view/themes/argon/header.htm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/luci-theme-argon/luasrc/view/themes/argon/header.htm b/luci-theme-argon/luasrc/view/themes/argon/header.htm
index 55e46a4..76129b7 100644
--- a/luci-theme-argon/luasrc/view/themes/argon/header.htm
+++ b/luci-theme-argon/luasrc/view/themes/argon/header.htm
@@ -151,7 +151,7 @@
 
 <body
 	class="lang_<%=luci.i18n.context.lang%> <% if node then %><%= striptags( node.title ) %><% end %> <% if luci.dispatcher.context.authsession then %>logged-in<% end %>"
-	data-page="<%= table.concat(disp.context.requestpath, "-") %>">
+	data-page="<%= pcdata(table.concat(disp.context.requestpath, "-")) %>">
 
 	<div class="main">
 		<div class="main-left" id="mainmenu" style="display:none">
