Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Device Details: <select> dropdowns (devGroup, devLocation, devSite, etc.) fail to select current value when it contains HTML special characters like '&'

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,853 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript, python, sqlite
Ambito
backend, frontend

Direzione di ricerca

Inizia in front/deviceDetailsEdit.php, nella parte relativa alla codifica di fieldData, e segui come overrideValue arriva a generateOptions() in front/js/settings_utils.js; l’issue indica anche front/js/db_methods.js come origine dei dati delle opzioni. Controlla come vengono confrontati i valori codificati con i valori grezzi del database, poi riproduci il problema con un gruppo come «Server \u0026 NAS». Il lavoro è completato quando l’opzione corrente è selezionata e il salvataggio di un altro campo conserva il gruppo.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Docker 🐋
What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?
The issue occurs in the following browsers. Select at least 2.
  • Firefox
  • Chrome
  • Edge
  • Safari (unsupported) - PRs welcome
  • N/A - This is an issue with the backend
Current Behavior

In deviceDetails.php (deviceDetailsEdit.php), when a <select> field such as devGroup, devLocation, or devSite has a stored value in the Devices table that contains an HTML special character (most commonly &, e.g. devGroup = "Server & NAS" or "Smart Home & Media"), the dropdown in the Device Details tab fails to mark the matching <option> as selected and instead falls back to the first option (❌None / "").

Furthermore, if the user subsequently edits any other field on that device and clicks Save, setDeviceData() reads $("#NEWDEV_devGroup").val() (which is "") and silently overwrites the device's devGroup with "" in the database.

Root Cause:

  1. In front/deviceDetailsEdit.php (line 336), fieldData is HTML-entity-encoded before being passed into generateFormHtml(): 
    // XSS prevention - encode special characters for string fields, but not for arrays (like children dynamic)
fieldData = encodeSpecialChars(fieldData);
    For "Server & NAS", fieldData becomes "Server &amp; NAS", which is passed as overrideValue -> inVal -> val -> valuesArray = ["Server &amp; NAS"].
  2. In front/js/db_methods.js (renderList) and front/js/settings_utils.js (generateOptions, lines 1014–1016), the available options for NEWDEV_devGroup are fetched via /dbquery/read (SELECT DISTINCT ... devGroup as id, devGroup as name FROM ...), which returns raw unencoded strings from SQLite (item.id = "Server & NAS").
  3. generateOptions() then checks: 
    let selected = options.length !== 0 && valuesArray.includes(item.id) ? 'selected' : '';
optionsHtml += `<option class="${cssClass}" value="${encodeSpecialChars(item.id)}" ${selected}>${encodeSpecialChars(labelName)}</option>`;
    Because valuesArray contains "Server &amp; NAS" (already encoded in deviceDetailsEdit.php:336) while item.id is "Server & NAS" (unencoded), valuesArray.includes(item.id) evaluates to false.

Note that generateFormHtml() / generateOptions() already encodes item.id and labelName via encodeSpecialChars() when rendering <option>, or for <input> fields in generateFormHtml() where val is interpolated. Alternatively, generateOptions() can compare valuesArray.includes(item.id) || valuesArray.includes(encodeSpecialChars(item.id)).

Expected Behavior

<select> dropdowns in deviceDetailsEdit.php (devGroup, devLocation, devSite, devType, etc.) should properly pre-select the device's current value even when the value contains & (e.g. "Server & NAS"), and saving the device should not wipe the field to "".

Steps To Reproduce
  1. Assign a device a devGroup containing &, e.g. Server & NAS (via Multi-Edit, Workflows, or Device Details).
  2. Reload deviceDetails.php?mac=<mac>.
  3. Observe that the Group (NEWDEV_devGroup) dropdown displays ❌None instead of Server & NAS, even though Server & NAS is present in the dropdown options list and in the database (Devices.devGroup).
  4. Click Save on the device -> devGroup is overwritten with "" (❌None).
Relevant app.conf settings
# Default NEWDEV_devGroup SQL options from server/plugins/newdev_template/config.json
NEWDEV_devGroup=""
docker-compose.yml
services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:26.10.0
    network_mode: host
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - NET_BIND_SERVICE
Debug or Trace enabled
  • I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.
Relevant app.log section
N/A (Pure frontend JavaScript issue in front/deviceDetailsEdit.php:336 and front/js/settings_utils.js:1014; backend /dbquery/read returns {"results":[{"id":"","name":"❌None"},{"id":"Server & NAS","name":"Server & NAS"}], "success":true})
Docker Logs
N/A (Frontend JS rendering issue in deviceDetailsEdit.php / settings_utils.js)
Lingua principale
Python
Stelle
7.2k
Fork
456
Merge medio
16h 25m
PR unite (30g)
30

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di netalertx/NetAlertX

Tutte le issue di netalertx/NetAlertX

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.