Refactor: Translations #2440
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,7 @@ Code="e918" | |
| Lock="true" | ||
| Tabs="true" | ||
| Cond="exec(\"grep -o '^SERVICE=.enable' /boot/config/domain.cfg 2>/dev/null\")" | ||
| Name="VMs" | ||
| --- | ||
| <?PHP | ||
| /* Copyright 2005-2023, Lime Technology | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1839,7 +1839,7 @@ function vm_clone($vm, $clone ,$overwrite,$start,$edit, $free, $waitID, $regenma | |
| } else { | ||
| $lastvmerror = $lv->get_last_error(); | ||
| $arrResponse = ['xml' => $xml,'error' => $lastvmerror]; | ||
| write("addLog\0".htmlspecialchars(sprintf(_("Creating XML Error: %s"),$lastvmerror))); | ||
| file_put_contents("/tmp/vmclonertn.debug", json_encode($arrResponse,JSON_PRETTY_PRINT)); | ||
| } | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -67,7 +67,7 @@ function execCommand_nchan($command,$idx) { | |
| $id = 1 ; | ||
| write(implode($style)."<p class='logLine'></p>"); | ||
| $process = " " ; | ||
| write("<p class='logLine'></p>","addLog\0<fieldset class='docker'><legend>".sprintf(_("Options for Block %s"),$action).": </legend><p class='logLine'></p><span id='wait-$waitID'>"._('Please wait')." </span></fieldset>"); | ||
| write("addLog\0".htmlspecialchars("VMName $name ")); | ||
| write("addLog\0".htmlspecialchars("SNAP $snapshotname ")); | ||
| write("addLog\0".htmlspecialchars("Base $targetbase ")); | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -86,7 +86,7 @@ function execCommand_nchan_clone($command,$idx,$refcmd=false) { | |
| write(implode($style)."<p class='logLine'></p>"); | ||
| $process = " " ; | ||
| $actiontxt = ucfirst($action) ; | ||
| write("<p class='logLine'></p>","addLog\0<fieldset class='docker'><legend>".sprintf(_("Options for %s"),$actiontxt).": </legend><p class='logLine'></p></fieldset>"); | ||
| write("addLog\0".htmlspecialchars("Cloning $name to $clone")); | ||
|
|
||
| switch ($action) { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -488,7 +488,7 @@ | |
|
|
||
| <blockquote class="inline_help"> | ||
| <p> | ||
| Specify the override storage pool for VM. This option allows you to specify the physical pool/disk used to store the disk images and snapshot data. | ||
| Default will follow standard processing and store images in the default location for the share defined in the settings. | ||
| A pool/disk(Volume) will be the location for images if the default is overridden. | ||
| </p> | ||
|
|
@@ -544,14 +544,14 @@ | |
| [$cpu1, $cpu2] = my_preg_split('/[,-]/',$pair); | ||
| if (!$cpu2) $corecount++; else $corecount=$corecount+2; | ||
| } | ||
| if (is_array($arrConfig['domain']['vcpu'])) {$coredisable = "disabled"; $vcpubuttontext = _("Deselect all");} else {$coredisable = ""; $vcpubuttontext = _("Select all");} | ||
| ?> | ||
| <td><span class="advanced">_(vCPUs)_:</span></td> | ||
| <td> | ||
| <span class="width"><select id="vcpus" <?=$coredisable?> name="domain[vcpus]" class="domain_vcpus narrow"> | ||
| <?for ($i = 1; $i <= ($corecount); $i++) echo mk_option($arrConfig['domain']['vcpus'], $i, $i);?> | ||
| </select> | ||
| <input type="button" value="<?=$vcpubuttontext?>" id="btnvCPUSelect"/></span> | ||
| </td> | ||
| <td></td> | ||
| </tr> | ||
|
|
@@ -1465,7 +1465,7 @@ | |
| </td> | ||
| <td></td> | ||
| </tr> | ||
| <tr id="gpubootvga{{INDEX}}" class="hidden"><td>_(Graphics ROM Needed)_:</td><td><span class="orange-text"><i class="fa fa-warning"></i> _(GPU is primary adapter, vbios may be required)_.</span></td></tr> | ||
| </table> | ||
| </script> | ||
|
|
||
|
|
@@ -2583,7 +2583,7 @@ function resetForm() { | |
| } | ||
| }); | ||
|
|
||
| $("#vmform").on("change", ".gpu", function changeGPUEvent(){ | ||
| const ValidGPUs = <?=json_encode($arrValidGPUDevices)?>; | ||
| var myvalue = $(this).val(); | ||
| var mylabel = $(this).children('option:selected').text(); | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -86,11 +86,12 @@ function missing_cache() { | |||||
| } | ||||||
|
|
||||||
| function resync($d) { | ||||||
| return in_array($d,['P','Q']) ? _('Parity-Sync') : _('Data-Rebuild'); | ||||||
| } | ||||||
|
|
||||||
| function print_error($error) { | ||||||
| $n = (int)($error ?: 0); | ||||||
| return sprintf(ngettext('Finding **%d** error','Finding **%d** errors',$n),$n); | ||||||
| } | ||||||
| ?> | ||||||
| <script> | ||||||
|
|
@@ -290,7 +291,7 @@ function stopArray(form) { | |||||
| $(form).append('<input type="hidden" name="cmdStop" value="Stop">'); | ||||||
| <?if ($confirm['stop']):?> | ||||||
| swal({ | ||||||
| title:"_(Proceed?)_", | ||||||
| text:"_(This will stop the array)_", | ||||||
| type:'warning', | ||||||
| html:true, | ||||||
|
|
@@ -309,7 +310,7 @@ function stopParity(form, text) { | |||||
| $(form).append('<input type="hidden" name="cmdCheckCancel" value="">'); | ||||||
| <?if ($confirm['stop']):?> | ||||||
| swal({ | ||||||
| title:"_(Proceed?)_", | ||||||
| text:"_(This will stop the running operation)_: "+text, | ||||||
| type:'warning', | ||||||
| html:true, | ||||||
|
|
@@ -384,7 +385,7 @@ function shutdown_now(form, cmd) { | |||||
| break; | ||||||
| } | ||||||
| swal({ | ||||||
| title:"_(Proceed?)_", | ||||||
| text:text, | ||||||
| type:'warning', | ||||||
| html:true, | ||||||
|
|
@@ -600,7 +601,7 @@ window.onunload = function(){ | |||||
| if (!$spot): | ||||||
| if ($action[0] == "recon"): | ||||||
| $resync = resync($action[1]); | ||||||
| ?> <tr><td></td><td><input type="submit" name="cmdCheckSync" value="_(Sync)_"></td><td>**<?=_('Sync')?>** <?=sprintf(_("will start **%s**"),$resync)?>.</td></tr> | ||||||
| <? elseif ($action[0]=="clear"):?> | ||||||
| <tr><td></td><td><input type="submit" name="cmdCheckClear" value="_(Clear)_"></td><td>**_(Clear)_** _(will start **Disk-Clear** of new data disk(s))_.</td></tr> | ||||||
| <? else: | ||||||
|
|
@@ -647,12 +648,12 @@ window.onunload = function(){ | |||||
| else: | ||||||
| if ($action[0] == "recon"): | ||||||
| $resync = resync($action[1]); | ||||||
| ?> <tr><td><?=sprintf(_("%s in progress"),$resync)?>.</td><td> | ||||||
| <span class="buttons-spaced"> | ||||||
| <input type="button" id="pauseButton"<?if (_var($var,'mdResync')):?> value="_(Pause)_" onclick="pauseParity(this.form)"<?else:?> value="_(Resume)_" onclick="resumeParity(this.form)"<?endif;?> disabled> | ||||||
| <input type="button" id="cancelButton" value="_(Cancel)_" onclick="stopParity(this.form,'<?=$resync?>')" disabled> | ||||||
| </span></td> | ||||||
| <td id="cancelText"><?if (_var($var,'mdResync')):?>**<?=_('Pause')?>** <?=sprintf(_("will pause %s"),$resync)?>.<?else:?>**<?=_('Resume')?>** <?=sprintf(_("will resume %s"),$resync)?>.<?endif;?><br>**<?=_('Cancel')?>** <?=sprintf(_("will stop %s"),$resync)?>. | ||||||
| <br>_(WARNING: canceling may leave the array unprotected)_!</td></tr> | ||||||
| <? elseif ($action[0] == "clear"):?> | ||||||
| <tr><td>_(Disk-Clear in progress)_.</td><td> | ||||||
|
|
@@ -681,7 +682,7 @@ window.onunload = function(){ | |||||
| $sbSynced = array_shift($synced) ?: _var($var,'sbSynced'); | ||||||
| $sbUpdate = _var($var,'mdResyncDt') ? $sbSynced : _var($var,'sbUpdated');?> | ||||||
| <tr><td></td><td><input type="button" value="_(History)_" onclick="parityHistory()"></td> | ||||||
| <td><?=(_('Current operation %1$s on **%2$s**'),(_var($var,'mdResyncDt')?_('started'):_('paused')),_(my_time($sbUpdate).day_count($sbUpdate),0))?></td></tr> | ||||||
|
Contributor
There was a problem hiding this comment. Missing sprintf call causes placeholder substitution failure. Line 685 is missing the Apply this diff to fix the issue: - <td><?=(_('Current operation %1$s on **%2$s**'),(_var($var,'mdResyncDt')?_('started'):_('paused')),_(my_time($sbUpdate).day_count($sbUpdate),0))?></td></tr>
+ <td><?=sprintf(_('Current operation %1$s on **%2$s**'),(_var($var,'mdResyncDt')?_('started'):_('paused')),_(my_time($sbUpdate).day_count($sbUpdate),0))?></td></tr>📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| <tr><td>_(Total size)_:</td><td id="line0"></td><td></td></tr> | ||||||
| <tr><td>_(Elapsed time)_:</td><td id="line1"></td><td></td></tr> | ||||||
| <tr><td>_(Current position)_:</td><td id="line2"></td><td></td></tr> | ||||||
|
|
@@ -707,12 +708,12 @@ window.onunload = function(){ | |||||
| case "Copying":?> | ||||||
| <tr><td><?status_indicator()?>**_(Starting, copying)_... <span id="fsState"></span>**</td><td><input type="submit" name="cmdNoCopy" value="_(Cancel)_"></td><td></td></tr> | ||||||
| <tr><td></td><td><input type="button" value="_(History)_" onclick="parityHistory()"></td> | ||||||
| <td><?=sprintf(_('Current operation started on **%s**'),_(my_time(_var($var,'sbUpdated',0)).day_count(_var($var,'sbUpdated',0)),0))?></td></tr> | ||||||
| <? break; | ||||||
| case "Clearing":?> | ||||||
| <tr><td><?status_indicator()?>**_(Started, clearing)_... <span id="fsState"></span>**</td><td><input type="submit" name="cmdNoClear" value="_(Cancel)_"></td><td></td></tr> | ||||||
| <tr><td></td><td><input type="button" value="_(History)_" onclick="parityHistory()"></td> | ||||||
| <td><?=sprintf(_('Current operation started on **%s**'),_(my_time(_var($var,'sbUpdated',0)).day_count(_var($var,'sbUpdated',0)),0))?></td></tr> | ||||||
| <? break; | ||||||
| case "Stopping":?> | ||||||
| <tr><td><?status_indicator()?>**_(Stopping)_...**</td><td><input type="submit" name="cmdStop" value="_(Stop)_" disabled></td><td></td></tr> | ||||||
|
|
@@ -746,7 +747,7 @@ window.onunload = function(){ | |||||
| if ($action[0] == "recon"): | ||||||
| $resync = resync($action[1]); | ||||||
| ?> <tr><td><?status_indicator()?>**_(Stopped)_**. _(Configuration valid)_.</td><td><input type="button" id="cmdStart" value="_(Start)_" onclick="prepareInput(this.form,this)"></td> | ||||||
| <td>**<?=_('Start')?>** <?=sprintf(_("will bring the array on-line and start **%s**"),$resync)?>.</td></tr> | ||||||
| <? elseif ($action[0] == "clear"):?> | ||||||
| <tr><td><?status_indicator()?>**_(Stopped)_**. _(New data disk(s) detected)_.</td><td><input type="button" id="cmdStart" value="_(Start)_" onclick="prepareInput(this.form,this)"></td> | ||||||
| <td>**_(Start)_** _(will bring the array on-line and start **Disk-Clear** of new data disk(s))_.</td></tr> | ||||||
|
|
||||||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
Escape template name before injecting into SweetAlert HTML.
This swal uses html:true and concatenates the unescaped
nameintotext. Iftmpl/nameever contains</&etc., this can render as HTML. Encode it first.Apply this diff:
function rmTemplate(tmpl) { var name = tmpl.split(/[\/]+/).pop(); - swal({title:"_(Are you sure?)_",text:"_(Remove template)_: "+name,type:"warning",html:true,showCancelButton:true,confirmButtonText:"_(Proceed)_",cancelButtonText:"_(Cancel)_"},function(){$("#rmTemplate").val(tmpl);$("#formTemplate1").submit();}); + var safeName = $('<div/>').text(name).html(); // encode for HTML + swal({title:"_(Are you sure?)_",text:"_(Remove template)_: "+safeName,type:"warning",html:true,showCancelButton:true,confirmButtonText:"_(Proceed)_",cancelButtonText:"_(Cancel)_"},function(){$("#rmTemplate").val(tmpl);$("#formTemplate1").submit();});Optionally, drop
html:truehere if no formatting is needed.Scan for other swal calls with
html:trueconcatenating variables:🏁 Script executed:
Length of output: 4008
🏁 Script executed:
Length of output: 78
🏁 Script executed:
Length of output: 62
🏁 Script executed:
Length of output: 318
🏁 Script executed:
Length of output: 0
Escape template name before injecting into SweetAlert HTML in both locations.
The
rmTemplatefunction concatenates an unescapednamevariable into the swaltextfield whilehtml:trueis enabled. This creates an XSS vulnerability iftmpl/namecontains HTML characters like<or&.Apply this fix to both:
function rmTemplate(tmpl) { var name = tmpl.split(/[\/]+/).pop(); - swal({title:"_(Are you sure?)_",text:"_(Remove template)_: "+name,type:"warning",html:true,showCancelButton:true,confirmButtonText:"_(Proceed)_",cancelButtonText:"_(Cancel)_"},function(){$("#rmTemplate").val(tmpl);$("#formTemplate1").submit();}); + var safeName = $('<div/>').text(name).html(); // encode for HTML + swal({title:"_(Are you sure?)_",text:"_(Remove template)_: "+safeName,type:"warning",html:true,showCancelButton:true,confirmButtonText:"_(Proceed)_",cancelButtonText:"_(Cancel)_"},function(){$("#rmTemplate").val(tmpl);$("#formTemplate1").submit();}); }function rmTemplate(tmpl) { var name = tmpl.split(/[\/]+/).pop(); - swal({title:"Are you sure?",text:"Remove template: "+name,type:"warning",html:true,showCancelButton:true},function(){$("#rmTemplate").val(tmpl);$("#formTemplate").submit();}); + var safeName = $('<div/>').text(name).html(); + swal({title:"Are you sure?",text:"Remove template: "+safeName,type:"warning",html:true,showCancelButton:true},function(){$("#rmTemplate").val(tmpl);$("#formTemplate").submit();}); }🤖 Prompt for AI Agents