From 54fef65b0f5e22300470d85a028c55397788491e Mon Sep 17 00:00:00 2001 From: vaneetha <140690118+vanemage@users.noreply.github.com> Date: Wed, 26 Aug 2026 23:20:42 +0530 Subject: [PATCH 1/4] RDKCOM-5628: RDKBDEV-3486 RDKBACCL-1962 Fix RDKB Security Vulnerability (#151) * RDKBACCL-1962 Fix RDKB Security Vulnerability * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Vaneetha Co-authored-by: Shirish Shrivastava <163453477+sshriv323@users.noreply.github.com> Co-authored-by: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- ...wireless_network_configuration_onewifi.jst | 36 +++++++++++++++---- 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst index 724b760..f19ccf4 100644 --- a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst +++ b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst @@ -51,6 +51,15 @@ function validChecksum($WPS_pin){ $accum += 1 * (intval($WPS_pin / 1) % 10); return (0 == ($accum % 10)); } +function ResolveRadioFromSsid($ssid){ + $ssid_tmp = String($ssid); + $ssid_lower_layers = String(getStr("Device.WiFi.SSID."+$ssid_tmp+".LowerLayers")); + LogStr(" : value of ssid_lower_layers" + $ssid_lower_layers); + if (preg_match('/Radio\\.1(\\.|$)/', $ssid_lower_layers) == 1) return 1; + if (preg_match('/Radio\\.2(\\.|$)/', $ssid_lower_layers) == 1) return 2; + if (preg_match('/Radio\\.3(\\.|$)/', $ssid_lower_layers) == 1) return 3; + return ""; + } function validFilterParam($ft){ for(var $keytmp in $ft) { $val=$ft[$keytmp];/*p2j-foreach*/ if(!(printableCharacters($val[0]) && validMAC($val[1]))) return false; @@ -66,7 +75,20 @@ if ($_POST['configInfo']) { //$jsConfig = '{"ssid_number":"1", "ft":[["1","2"],["c","d"]], "target":"save_filter"}'; $arConfig = json_decode($jsConfig, true); //print_r($arConfig); -$i = $arConfig['ssid_number']; +$i = (array_key_exists('ssid_number', $arConfig)) ? String($arConfig['ssid_number']) : ""; +$ssid_log = substr(String($i), 0, 32); +if ($i != "" && strlen($i) > 3) { + LogStr(" : security_event:invalid_ssid_number_length:" + String(strlen($i)) + " value_prefix:" + $ssid_log); + http_response_code(400); + echo( '{"error":"invalid_ssid_number"}'); + exit(0); +} +if ($i != "" && preg_match("/^(?:[1-9]|1[0-9]|2[0-4])$/", $i) != 1) { + LogStr(" : security_event:invalid_ssid_number_format value_prefix:" + $ssid_log); + http_response_code(400); + echo( '{"error":"invalid_ssid_number"}'); + exit(0); +} if($i == "17") { $Radio_3_Enable = getStr("Device.WiFi.Radio.3.Enable"); @@ -111,11 +133,13 @@ if (array_key_exists('band_steering', $arConfig)) } else { - $i = $arConfig['ssid_number']; - if($i == 17) - $r=3; //17th is private ssid for 6 GHz(radio 3) - else - $r = $i; + $r = ResolveRadioFromSsid($i); + if ($r == "") { + LogStr(" : ResolveRadioFromSsid returned security_event:invalid_ssid_mapping ssid:" + substr(String($i), 0, 32)); + http_response_code(400); + echo( '{"error":"invalid_ssid_mapping"}'); + exit(0); + } $channel = getStr("Device.WiFi.Radio."+$r+".AutoChannelEnable"); if ("save_config" == $arConfig['target']) { From cafe4c87f7d585d144399277c6af950170731392 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Mon, 31 Aug 2026 21:19:29 +0530 Subject: [PATCH 2/4] XB10-2825: [RATS][Aker] Device Pause page is not loading (#158) * XB10-2825: [RATS][Aker] Device Pause page is not loading when then client is paused * webgui.sh: fix inverted directory check before copying to pcontrol Copy to /tmp/pcontrol only when the source directory is present for /usr/www/cmn and /usr/hgw --- source/Styles/xb3/config/webgui.sh | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/source/Styles/xb3/config/webgui.sh b/source/Styles/xb3/config/webgui.sh index dd48f1b..47fb817 100755 --- a/source/Styles/xb3/config/webgui.sh +++ b/source/Styles/xb3/config/webgui.sh @@ -152,10 +152,19 @@ fi if [ ! -d "/tmp/pcontrol" ] then - mkdir /tmp/pcontrol + mkdir /tmp/pcontrol +fi + +if [ -d "/usr/www/cmn" ] +then + cp -rf /usr/www/cmn/ /tmp/pcontrol +fi + +if [ -d "/usr/hgw" ] +then + cp -rf /usr/hgw/cmn/ /tmp/pcontrol fi -cp -rf /usr/www/cmn/ /tmp/pcontrol #Dynamically create pause screen file #removed chmod as part of CISCOXB3-6294 since etc is read-only FileSystem sh /etc/pauseBlockGenerateHtml.sh From adf8275a31cf87e0969f405785b830c3999759fa Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B <57708013+pavankumar464@users.noreply.github.com> Date: Tue, 1 Sep 2026 05:16:56 +0530 Subject: [PATCH 3/4] RDKB-66533 : Harden $_GET['mac_ssid'] handling with shared validation helper (#152) * RDKB-66533 : Harden $_GET['mac_ssid'] handling with shared validation helper Reason for change: Fix $_GET['mac_ssid'] handling Test Procedure: Test for Wi-Fi MAC Filter Setting Risks: High Priority: P1 * mac_ssid validation and JSON-safe encoding * Move mac_ssid validation into shared utility helper * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Check and apply SSID value only if it exists --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Harnish Patel <163233851+hpatel006c@users.noreply.github.com> --- source/Styles/xb3/jst/includes/utility.jst | 13 +++++++++++++ .../xb3/jst/wireless_network_configuration.jst | 10 +++++----- .../xb6/jst/wireless_network_configuration.jst | 10 +++++----- .../jst/wireless_network_configuration_onewifi.jst | 10 +++++----- 4 files changed, 28 insertions(+), 15 deletions(-) diff --git a/source/Styles/xb3/jst/includes/utility.jst b/source/Styles/xb3/jst/includes/utility.jst index af44841..db0f48d 100644 --- a/source/Styles/xb3/jst/includes/utility.jst +++ b/source/Styles/xb3/jst/includes/utility.jst @@ -1148,6 +1148,19 @@ function cleanJsonDms($dm_key, $param_json) { return $param_json; } +function getValidatedMacSsidValueJs() { + var $mac_ssid_v = ""; + if(isset($_GET['mac_ssid']) && preg_match('/^\d+$/', $_GET['mac_ssid']) == 1) { + $mac_ssid_v = intval($_GET['mac_ssid']); + if ($mac_ssid_v < 1 || $mac_ssid_v > 17) + $mac_ssid_v = ""; + else + $mac_ssid_v = String($mac_ssid_v); + } + + return htmlspecialchars(json_encode($mac_ssid_v), ENT_NOQUOTES, 'UTF-8'); +} + /** * Discription: time rounded to 5 min * diff --git a/source/Styles/xb3/jst/wireless_network_configuration.jst b/source/Styles/xb3/jst/wireless_network_configuration.jst index 24a115c..7abc145 100644 --- a/source/Styles/xb3/jst/wireless_network_configuration.jst +++ b/source/Styles/xb3/jst/wireless_network_configuration.jst @@ -28,8 +28,6 @@ Connection > Wi-Fi", "nav-wifi-config"); if ("" != $ret){echo( $ret); exit(0);} - if(isset($_GET['mac_ssid'])) - if ($_GET['mac_ssid'] > 18) die(); ?> "; - var ssids = ""; - if((ssids.includes(mac_ssid_GET)) && mac_ssid_GET) { + var mac_ssid_GET = ; + if (mac_ssid_GET !== "" && $("#mac_ssid option[value='" + mac_ssid_GET + "']").length > 0) { $("#mac_ssid").val(mac_ssid_GET); } update_Wi_Fi_control_list(); diff --git a/source/Styles/xb6/jst/wireless_network_configuration.jst b/source/Styles/xb6/jst/wireless_network_configuration.jst index ba9ec5f..465784e 100644 --- a/source/Styles/xb6/jst/wireless_network_configuration.jst +++ b/source/Styles/xb6/jst/wireless_network_configuration.jst @@ -28,8 +28,6 @@ Connection > Wi-Fi", "nav-wifi-config"); if ("" != $ret){echo( $ret); exit(0);} - if(isset($_GET['mac_ssid'])) - if ($_GET['mac_ssid'] > 18) die(); ?> "; - var ssids = ""; - if((ssids.includes(mac_ssid_GET)) && mac_ssid_GET) { + var mac_ssid_GET = ; + if (mac_ssid_GET !== "" && $("#mac_ssid option[value='" + mac_ssid_GET + "']").length > 0) { $("#mac_ssid").val(mac_ssid_GET); } update_Wi_Fi_control_list(); diff --git a/source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst b/source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst index 47cb67b..15f7fc3 100644 --- a/source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst +++ b/source/Styles/xb6/jst/wireless_network_configuration_onewifi.jst @@ -28,8 +28,6 @@ Connection > Wi-Fi", "nav-wifi-config"); if ("" != $ret){echo( $ret); exit(0);} - if(isset($_GET['mac_ssid'])) - if ($_GET['mac_ssid'] > 18) die(); ?> "; - var ssids = ""; - if((ssids.includes(mac_ssid_GET)) && mac_ssid_GET) { + var mac_ssid_GET = ; + if (mac_ssid_GET !== "" && $("#mac_ssid option[value='" + mac_ssid_GET + "']").length > 0) { $("#mac_ssid").val(mac_ssid_GET); } update_Wi_Fi_control_list(); From 45e7f6acacdb0ce24e67c1a46c963b08d740499b Mon Sep 17 00:00:00 2001 From: bunnam988 Date: Wed, 2 Sep 2026 07:26:56 +0000 Subject: [PATCH 4/4] Add changelog for release 2.10.0 --- CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 479207c..0acc834 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,19 @@ All notable changes to this project will be documented in this file. Dates are d Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog). +#### [2.10.0](https://github.com/rdkcentral/webui/compare/2.9.0...2.10.0) + +- RDKB-66533 : Harden $_GET['mac_ssid'] handling with shared validation helper [`#152`](https://github.com/rdkcentral/webui/pull/152) +- XB10-2825: [RATS][Aker] Device Pause page is not loading [`#158`](https://github.com/rdkcentral/webui/pull/158) +- RDKCOM-5628: RDKBDEV-3486 RDKBACCL-1962 Fix RDKB Security Vulnerability [`#151`](https://github.com/rdkcentral/webui/pull/151) +- Merge tag '2.9.0' into develop [`df73ccc`](https://github.com/rdkcentral/webui/commit/df73ccc46951666a33a3469f548a99e1c5b4ccae) + #### [2.9.0](https://github.com/rdkcentral/webui/compare/2.8.0...2.9.0) +> 21 August 2026 + - RDKB-66345 Disable 160MHz if DFS at boot up is false [`#149`](https://github.com/rdkcentral/webui/pull/149) +- Add changelog for release 2.9.0 [`e422bc5`](https://github.com/rdkcentral/webui/commit/e422bc560fb51d1b3a3fefc08ab1440537fee3ff) #### [2.8.0](https://github.com/rdkcentral/webui/compare/2.7.1...2.8.0)