luci-mod-system: fix potential stored XSS

Make sure to escape the key contents in the delete confirmation dialog.

Signed-off-by: Jo-Philipp Wich <[email protected]>
(cherry picked from commit 0186d7eae0e123a409e9919a83fdfecc7945c984)

diff --git a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
index 8b12b2311e4591cd5706ae951b1d629c1a04ea99..9aacdb96bbe34aee9d5f5a95e1093dddd2156ac9 100644 (file)
--- a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
+++ b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
@@ -198,7 +198,7 @@ function removeKey(ev) {
 
        L.showModal(_('Delete key'), [
                E('div', _('Do you really want to delete the following SSH key?')),
-               E('pre', delkey),
+               E('pre', [ delkey ]),
                E('div', { class: 'right' }, [
                        E('div', { class: 'btn', click: L.hideModal }, _('Cancel')),
                        ' ',