Console: Fix filtering and escaping on /configclients

Fix autostart setting on new client, was inverted

apps/routerconsole/java/src/net/i2p/router/web/ConfigClientsHandler.java

@@ -244,7 +244,7 @@ public class ConfigClientsHandler extends FormHandler {
             // edit of an existing entry
             if (_context.getBooleanProperty(ConfigClientsHelper.PROP_ENABLE_CLIENT_CHANGE) ||
                 isAdvanced()) {
-                String desc = getJettyString("desc" + cur);
+                String desc = getJettyString("nofilter_desc" + cur);
                 if (desc != null) {
                     int spc = desc.indexOf(" ");
                     String clss = desc;
@@ -255,7 +255,7 @@ public class ConfigClientsHandler extends FormHandler {
                     }
                     ca.className = clss;
                     ca.args = args;
-                    ca.clientName = getJettyString("name" + cur);
+                    ca.clientName = getJettyString("nofilter_name" + cur);
                 }
             }
         }
@@ -264,7 +264,7 @@ public class ConfigClientsHandler extends FormHandler {
         if (_context.getBooleanProperty(ConfigClientsHelper.PROP_ENABLE_CLIENT_CHANGE) ||
             isAdvanced()) {
             int newClient = clients.size();
-            String newDesc = getJettyString("desc" + newClient);
+            String newDesc = getJettyString("nofilter_desc" + newClient);
             if (newDesc != null && newDesc.trim().length() > 0) {
                 // new entry
                 int spc = newDesc.indexOf(" ");
@@ -274,10 +274,10 @@ public class ConfigClientsHandler extends FormHandler {
                     clss = newDesc.substring(0, spc);
                     args = newDesc.substring(spc + 1);
                 }
-                String name = getJettyString("name" + newClient);
+                String name = getJettyString("nofilter_name" + newClient);
                 if (name == null || name.trim().length() <= 0) name = "new client";
                 ClientAppConfig ca = new ClientAppConfig(clss, name, args, 2*60*1000,
-                                                         _settings.get(newClient + ".enabled") != null);
+                                                         _settings.get(newClient + ".enabled") == null);  // true for disabled
                 clients.add(ca);
                 addFormNotice(_t("New client added") + ": " + name + " (" + clss + ").");
             }

apps/routerconsole/java/src/net/i2p/router/web/ConfigClientsHelper.java

@@ -322,23 +322,24 @@ public class ConfigClientsHelper extends HelperBase {
                             boolean enabled, boolean ro, boolean preventDisable, String desc, boolean edit,
                             boolean showEditButton, boolean showUpdateButton, boolean showStopButton,
                             boolean showDeleteButton, boolean showStartButton) {
-        String escapeddesc = DataHelper.escapeHTML(desc);
+        String escapedName = DataHelper.escapeHTML(name);
+        String escapedDesc = DataHelper.escapeHTML(desc);
         buf.append("<tr><td class=\"mediumtags\" align=\"right\" width=\"25%\">");
         if (urlify && enabled) {
             String link = "/";
             if (! RouterConsoleRunner.ROUTERCONSOLE.equals(name))
-                link += name + "/";
+                link += escapedName + "/";
-            buf.append("<a href=\"").append(link).append("\">").append(_t(name)).append("</a>");
+            buf.append("<a href=\"").append(link).append("\">").append(_t(escapedName)).append("</a>");
         } else if (edit && !ro) {
-            buf.append("<input type=\"text\" name=\"name").append(index).append("\" value=\"");
+            buf.append("<input type=\"text\" name=\"nofilter_name").append(index).append("\" value=\"");
             if (name.length() > 0)
-                buf.append(_t(name));
+                buf.append(_t(escapedName));
             buf.append("\" >");
         } else {
             if (name.length() > 0)
-                buf.append(_t(name));
+                buf.append(_t(escapedName));
         }
-        buf.append("</td><td align=\"center\" width=\"10%\"><input type=\"checkbox\" class=\"optbox\" name=\"").append(index).append(".enabled\" value=\"true\" ");
+        buf.append("</td><td align=\"center\" width=\"10%\"><input type=\"checkbox\" class=\"optbox\" name=\"").append(index).append(".enabled\"");
         if (enabled) {
             buf.append("checked=\"checked\" ");
             if (ro || preventDisable)
@@ -366,17 +367,17 @@ public class ConfigClientsHelper extends HelperBase {
         if (showDeleteButton && (!edit) && !ro) {
             buf.append("<button type=\"submit\" class=\"Xdelete\" name=\"action\" value=\"Delete ").append(index)
                .append("\" onclick=\"if (!confirm('")
-               .append(_t("Are you sure you want to delete {0}?", _t(name)))
+               .append(_t("Are you sure you want to delete {0}?", _t(escapedName)))
                .append("')) { return false; }\">")
                .append(_t("Delete")).append("<span class=hide> ").append(index).append("</span></button>");
         }
         buf.append("</td><td align=\"left\" width=\"50%\">");
         if (edit && !ro) {
-            buf.append("<input type=\"text\" size=\"80\" spellcheck=\"false\" name=\"desc").append(index).append("\" value=\"");
+            buf.append("<input type=\"text\" size=\"80\" spellcheck=\"false\" name=\"nofilter_desc").append(index).append("\" value=\"");
-            buf.append(escapeddesc);
+            buf.append(escapedDesc);
             buf.append("\" >");
         } else {
-            buf.append(desc);
+            buf.append(escapedDesc);
         }
         buf.append("</td></tr>\n");
     }

history.txt

@@ -1,11 +1,16 @@
+2015-11-12 zzz
+ * Console /configclients:
+   = Fix filtering and escaping
+   - Fix autostart setting on new client, was inverted
+
 2015-11-11 zzz
  * i2psnark:
-   - Change log level to hide socket closed error at tunnel shutdown
+   - Change log level to hide socket closed error at tunnel shutdown (ticket #1687)
    - Increase max pieces
  * Timers: State fix 4th try (tickets #1694, #1705)
 
 2015-11-05 zzz
- * I2CP: Fix additional connections getting rejected during tunnel open (ticket #1650)
+ * I2CP: Fix additional connections getting rejected during tunnel open (tickets #1650, #1698)
  * Streaming: Split blacklist into one for EC and one for Ed
 
 2015-11-04 zzz

router/java/src/net/i2p/router/RouterVersion.java

@@ -18,7 +18,7 @@ public class RouterVersion {
     /** deprecated */
     public final static String ID = "Monotone";
     public final static String VERSION = CoreVersion.VERSION;
-    public final static long BUILD = 25;
+    public final static long BUILD = 26;
 
     /** for example "-test" */
     public final static String EXTRA = "-rc";