stephane.david/GridTV
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: harden proxy.php with config whitelist, fix XSS via EPG innerHTML

Browse Source
This commit is contained in:
Johnnybegood90
2026-03-14 02:26:36 +01:00
parent 17db9f56f7
commit 30d8a24927
4 changed files with 67 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/js/mobile.js
+2 -2
View File
@@ -39,12 +39,12 @@ function renderMobile() {
}
const timeCol = document.createElement('div'); timeCol.className='mobile-program-time';
timeCol.innerHTML = `<span>${fmtTime(p.start)}</span><span>${fmtTime(p.stop)}</span>`;
timeCol.innerHTML = `<span>${esc(fmtTime(p.start))}</span><span>${esc(fmtTime(p.stop))}</span>`;
item.appendChild(timeCol);
const info = document.createElement('div'); info.className='mobile-program-info';
const ep = fmtEpisode(p.season, p.episode);
info.innerHTML = `<div class="mobile-program-title">${p.title}</div><div class="mobile-program-dur">${ep ? ep + ' · ' : ''}${dur} min</div>`;
info.innerHTML = `<div class="mobile-program-title">${esc(p.title)}</div><div class="mobile-program-dur">${ep ? esc(ep) + ' · ' : ''}${dur} min</div>`;
item.appendChild(info);
if (isLive) {
src/js/search.js
+2 -2
View File
@@ -179,12 +179,12 @@ function renderMobileFiltered(filteredChannels, q) {
}
const timeCol = document.createElement('div'); timeCol.className = 'mobile-program-time';
timeCol.innerHTML = `<span>${fmtTime(p.start)}</span><span>${fmtTime(p.stop)}</span>`;
timeCol.innerHTML = `<span>${esc(fmtTime(p.start))}</span><span>${esc(fmtTime(p.stop))}</span>`;
item.appendChild(timeCol);
const info = document.createElement('div'); info.className = 'mobile-program-info';
const ep = fmtEpisode(p.season, p.episode);
info.innerHTML = `<div class="mobile-program-title">${p.title}</div><div class="mobile-program-dur">${ep ? ep + ' · ' : ''}${dur} min</div>`;
info.innerHTML = `<div class="mobile-program-title">${esc(p.title)}</div><div class="mobile-program-dur">${ep ? esc(ep) + ' · ' : ''}${dur} min</div>`;
item.appendChild(info);
if (isLive) {
src/js/utils.js
+7
View File
@@ -1,4 +1,11 @@
// Echapper les donnees issues de l'EPG pour eviter les injections HTML
function esc(str) {
const d = document.createElement('div');
d.textContent = str || '';
return d.innerHTML;
}
let channels = [];
let programs = {};
let m3uStreams = {}; // slug normalisé → url stream