// escapeHtml escapes characters that are significant in HTML so that // user-controlled values (client names, emails, notes, ...) cannot be used to // inject markup or scripts when interpolated into the DOM. function escapeHtml(value) { if (value === null || value === undefined) { return ''; } return String(value) .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } function renderClientList(data) { $.each(data, function(index, obj) { const clientName = escapeHtml(obj.Client.name); // render telegram button let telegramButton = '' if (obj.Client.telegram_userid) { telegramButton = `
` } let telegramHtml = ""; if (obj.Client.telegram_userid && obj.Client.telegram_userid.length > 0) { telegramHtml = `` } // render client status css tag style let clientStatusHtml = '>' if (obj.Client.enabled) { clientStatusHtml = `style="visibility: hidden;">` } // render client allocated ip addresses let allocatedIpsHtml = ""; $.each(obj.Client.allocated_ips, function(index, obj) { allocatedIpsHtml += `${escapeHtml(obj)} `; }) // render client allowed ip addresses let allowedIpsHtml = ""; $.each(obj.Client.allowed_ips, function(index, obj) { allowedIpsHtml += `${escapeHtml(obj)} `; }) let subnetRangesString = ""; if (obj.Client.subnet_ranges && obj.Client.subnet_ranges.length > 0) { subnetRangesString = escapeHtml(obj.Client.subnet_ranges.join(',')) } let additionalNotesHtml = ""; if (obj.Client.additional_notes && obj.Client.additional_notes.length > 0) { additionalNotesHtml = `` } // render client html content let html = `
${telegramButton}
${clientName} ${telegramHtml} ${additionalNotesHtml} ${escapeHtml(obj.Client.email)} ${prettyDateTime(obj.Client.created_at)} ${prettyDateTime(obj.Client.updated_at)} ${obj.Client.use_server_dns ? 'DNS enabled' : 'DNS disabled'} ${escapeHtml(obj.Client.additional_notes)} IP Allocation` + allocatedIpsHtml + `Allowed IPs` + allowedIpsHtml +`
` // add the client html elements to the list $('#client-list').append(html); }); } function renderUserList(data) { $.each(data, function(index, obj) { let clientStatusHtml = '>' const username = escapeHtml(obj.username); // render user html content let html = `

${username} ${obj.admin? 'Administrator':'Manager'}
` // add the user html elements to the list $('#users-list').append(html); }); } function prettyDateTime(timeStr) { const dt = new Date(timeStr); const offsetMs = dt.getTimezoneOffset() * 60 * 1000; const dateLocal = new Date(dt.getTime() - offsetMs); return dateLocal.toISOString().slice(0, 19).replace(/-/g, "/").replace("T", " "); }