From 033ce77d76e8ffa721a105ab4536414d14df2c4b Mon Sep 17 00:00:00 2001 From: wipedlifepotato <60944239+wipedlifepotato@users.noreply.github.com> Date: Sat, 29 Aug 2026 09:11:32 +0300 Subject: [PATCH 1/3] use a textContent without innerHTML --- contrib/webconsole/torrent_client.html | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/contrib/webconsole/torrent_client.html b/contrib/webconsole/torrent_client.html index d84ac331..5552313e 100644 --- a/contrib/webconsole/torrent_client.html +++ b/contrib/webconsole/torrent_client.html @@ -37,11 +37,11 @@ currentTorrentsData = r.result.torrents; if (currentTorrentsData.length === 0) { - torrents.innerHTML = '
  • No downloads
    • '; + torrents.textContent = '
  • No downloads
    • '; return; } - torrents.innerHTML = currentTorrentsData.map(el => { + torrents.textContent = currentTorrentsData.map(el => { const percent = el.percentDone ? (el.percentDone*100).toFixed(2) : 0.0; const speed = window.tjs.formatBytes ? window.tjs.formatBytes(el.rateDownload) : `${el.rateDownload} B/s`; const speedUp = window.tjs.formatBytes ? window.tjs.formatBytes(el.rateUpload) : `${el.rateUpload} B/s`; @@ -91,18 +91,18 @@ document.getElementById('modal_torrent_title').textContent = `DETAILS: ${torrent.name} (#${torrent.id})`; const filesList = document.getElementById('modal_files_list'); - filesList.innerHTML = torrent.files?.length + filesList.textContent = torrent.files?.length ? torrent.files.map(f => `
  • ${f.name} — ${(f.bytesCompleted / 1048576).toFixed(2)} / ${(f.length / 1048576).toFixed(2)} MB (${((f.bytesCompleted / f.length) * 100 || 0).toFixed(1)}%)
    • `).join('') : '
  • NO_FILES
    • '; const peersList = document.getElementById('modal_peers_list'); const trackersList = document.getElementById('modal_trackers_list'); document.getElementById('peer_count').textContent = torrent.peers ? torrent.peers.length : 0; - peersList.innerHTML = torrent.peers?.length + peersList.textContent = torrent.peers?.length ? torrent.peers.map(p => `
  • ${p.address} (${p.clientName || 'Unk'}) — ${(p.rateToClient/1024).toFixed(2)} KB/s — ${(p.rateToPeer/1024).toFixed(2)} KB/s
    • `).join('') : '
  • NO_PEERS
    • '; - trackersList.innerHTML = torrent.trackers?.length + trackersList.textContent = torrent.trackers?.length ? torrent.trackers.map(p => `
  • [id:${p.id}] announce: ${p.announce} ; tier - ${p.tier}
    • `).join('') : '
  • NO_TRACKERS
    • '; From 0ee5e04a069a611699e7385eec075dc36999017b Mon Sep 17 00:00:00 2001 From: wipedlifepotato <60944239+wipedlifepotato@users.noreply.github.com> Date: Sat, 29 Aug 2026 09:17:44 +0300 Subject: [PATCH 2/3] without XSS torrents list --- contrib/webconsole/torrent_client.html | 29 ++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/contrib/webconsole/torrent_client.html b/contrib/webconsole/torrent_client.html index 5552313e..3da9609b 100644 --- a/contrib/webconsole/torrent_client.html +++ b/contrib/webconsole/torrent_client.html @@ -41,7 +41,8 @@ return; } - torrents.textContent = currentTorrentsData.map(el => { + torrents.innerHTML=""; + currentTorrentsData.map(el => { const percent = el.percentDone ? (el.percentDone*100).toFixed(2) : 0.0; const speed = window.tjs.formatBytes ? window.tjs.formatBytes(el.rateDownload) : `${el.rateDownload} B/s`; const speedUp = window.tjs.formatBytes ? window.tjs.formatBytes(el.rateUpload) : `${el.rateUpload} B/s`; @@ -49,12 +50,28 @@ const totalSize = el.totalSize; // bytes const ETA = el.rateDownload ? (((totalSize * (1 - el.percentDone)) / el.rateDownload) / 60).toFixed(1) + " min" : "-"; const name = el.name || '|unknown name, maybe a bad torrent|'; + //torrents.textContent = + //return `
  • + // + // + // + //
    • `; + const li = document.createElement('li'); + const span = document.createElement('span') + span.textContent = `${name} — ${percent}% [${status}] (⬇ ${speed} | ⬆ ${speedUp}) ---- size = ${(totalSize/1024/1024).toFixed(2)}mb; ETA: ${ETA}` + li.appendChild(span) + // + const butDetails = document.createElement('button'); + butDetails.textContent = 'Details'; + butDetails.onclick = () => openTorrentDetails(el.id); + li.appendChild(butDetails); + // + const butRemove = document.createElement('button'); + butRemove.textContent = '✕'; + butRemove.onclick = () => removeTorrent(el.id); + li.appendChild(butRemove); + torrents.appendChild(li) - return `
  • - ${name} — ${percent}% [${status}] (⬇ ${speed} | ⬆ ${speedUp}) ---- size = ${(totalSize/1024/1024).toFixed(2)}mb; ETA: ${ETA} - - -
    • `; }).join(''); } catch (err) { statusIndicator.textContent = 'STATUS: ERROR_WITH_DATA (f12, check your console and write issue)'; From 51a6dcd3ecd1f597d1afed5ce3071f99feb0b3f1 Mon Sep 17 00:00:00 2001 From: wipedlifepotato <60944239+wipedlifepotato@users.noreply.github.com> Date: Sat, 29 Aug 2026 09:23:31 +0300 Subject: [PATCH 3/3] xss fix --- contrib/webconsole/torrent_client.html | 286 +++++++++++++++---------- 1 file changed, 176 insertions(+), 110 deletions(-) diff --git a/contrib/webconsole/torrent_client.html b/contrib/webconsole/torrent_client.html index 3da9609b..8b3a645e 100644 --- a/contrib/webconsole/torrent_client.html +++ b/contrib/webconsole/torrent_client.html @@ -1,135 +1,201 @@
    - Torrent Client -
    -

    _

    - - - -
    + Torrent Client +
    +

    _

    + + + +
    -