9 replies to this topic

[SatRider]

Hi, there is an issue in OpenWebif with the link to stream the current service (tooltip "Stream:<program name>") located in the top right on the OpenWebif page ("osd" div).
When a recording is played and the filename (i.e. the name of the recorded program/transmission) contains one or more single quotes (that is an apostrophe, so is relatively common in some languages) the browser (chrome in my test) console show the error "Uncaught SyntaxError: missing ) after argument list".

The problem is that internally the onclick event call the jumper80(<path>) javascript function (remember, when playing a recorded program) with the filename as argument and the filename is not properly escaped, so if it contains a single quote.......it breaks.

For the record I'm using VU+ Suo4K SE with OpenPli 8.1-release build 2021-09-15, last update 2021-10-12, but I think the problem exists in any decoder using OpenWebif.

I understand that, as far as I'm aware of, OpenWebif is not maintained directly by the OpenPli team but....I'm not sure where else to report this issue!

[ims]

Try report it here

[SatRider]

Try report it here

Done, here

[ims]

 

Try report it here

Done, here

 

Thx. Btw - you have there next question.

[SatRider]

This is the reply to my submitted issue:

 

"This looks more like an issue of PLi. The recording filenames should not have such special chars like '."

 

It seems odd to me since I had the impression that in any Enigma2 image the recording filename is the "name" of the program from epg, but I might be wrong, I'm no expert at all, so maybe that's true only for OpenPli?

[WanWizard]

I've responded to that issue.

[SatRider]

It has been fixed

 

Not trying to put any pressure (I'll fix it myself in my box), just for info/curiosity (I've no idea how the build process works), when it may be included in OpenPLI?

Future update? Future release?

 

Thank you for the help/support

[WanWizard]

Hmm... quite a horrible fix, but who am I.

 

Nightly build images are created continuously, so it will be available in the next build (the one that starts when this currently running one is finished).

Supported release images are built once a week, the current version (now 8.1) on Sunday, the previous version (now 7.3) on Wednesday.

 

That means you've just missed it, and have to wait until next week.

[SatRider]

Thank you for the info, it's always nice to understand/learn how things (your build process in this case) works.

No problem waiting, I have replaced the js with the "fixed" one and works, the title/tooltip is still broken (unescaped), so it's truncated....but that's is really a minor issue (already commented in github).

 

As for the fix....well....my point is more on the process, in my opinion ideally EVERYTHING should be properly encoded/escaped BY DESIGN in the development process, not "fixed" as "wrong characters" appear in usage cases.

Other products/projects may (and really DO) open BIG security holes when "things" are not encoded/escaped properly. Sure enough my STB is definitely not something I consider secure, nor I think it should be.

 

But hey, I'm definitely less of what you are...sooo....

[WanWizard]

I totally agree with you. That is why I replied on the issue.