From 7407259433104bb54cc85ba0cb35bb6fd3eb2b71 Mon Sep 17 00:00:00 2001
From: bergware <bergware@users.noreply.github.com>
Date: Sat, 4 Jan 2020 10:20:02 +0100
Subject: [PATCH 1/4] Dashboard: adjusted table positioning

---
 plugins/dynamix/styles/default-azure.css | 12 ++++++------
 plugins/dynamix/styles/default-black.css | 12 ++++++------
 plugins/dynamix/styles/default-gray.css  | 12 ++++++------
 plugins/dynamix/styles/default-white.css | 12 ++++++------
 4 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/plugins/dynamix/styles/default-azure.css b/plugins/dynamix/styles/default-azure.css
index 7ee8f2579..369ad5dc4 100644
--- a/plugins/dynamix/styles/default-azure.css
+++ b/plugins/dynamix/styles/default-azure.css
@@ -225,14 +225,14 @@ table.share_status.dashboard.box3 tr td:nth-child(4){min-width:11%}
 table.share_status.dashboard.box3 tr td:nth-child(5){min-width:11%}
 table.share_status.dashboard.box3 tr td[colspan="4"]{min-width:93%}
 @media (max-width:1680px){
- table.share_status.dashboard.box1{width:44%}
- table.share_status.dashboard.box2{width:52%;float:right}
- table.share_status.dashboard.box3{width:52%;float:right}
+ table.share_status.dashboard.box1{width:45.4%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:53.4%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:53.4%;margin-left:0;margin-right:0;float:right}
 }
 @media (min-width:1681px){
- table.share_status.dashboard.box1{width:28%}
- table.share_status.dashboard.box2{width:34%;float:right}
- table.share_status.dashboard.box3{width:34%;margin-left:20px}
+ table.share_status.dashboard.box1{width:28.6%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:34.6%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:34.6%;margin-left:20px;margin-right:0}
 }
 tr.alert{color:#f0000c;background-color:#ff9e9e}
 tr.warn{color:#e68a00;background-color:#feefb3}
diff --git a/plugins/dynamix/styles/default-black.css b/plugins/dynamix/styles/default-black.css
index a5b83fa7a..396f07296 100644
--- a/plugins/dynamix/styles/default-black.css
+++ b/plugins/dynamix/styles/default-black.css
@@ -215,14 +215,14 @@ table.share_status.dashboard.box3 tr td:nth-child(4){min-width:11%}
 table.share_status.dashboard.box3 tr td:nth-child(5){min-width:11%}
 table.share_status.dashboard.box3 tr td[colspan="4"]{min-width:93%}
 @media (max-width:1680px){
- table.share_status.dashboard.box1{width:44%}
- table.share_status.dashboard.box2{width:52%;float:right}
- table.share_status.dashboard.box3{width:52%;float:right}
+ table.share_status.dashboard.box1{width:45.4%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:53.4%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:53.4%;margin-left:0;margin-right:0;float:right}
 }
 @media (min-width:1681px){
- table.share_status.dashboard.box1{width:28%}
- table.share_status.dashboard.box2{width:34%;float:right}
- table.share_status.dashboard.box3{width:34%;margin-left:20px}
+ table.share_status.dashboard.box1{width:28.6%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:34.6%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:34.6%;margin-left:22px;margin-right:0}
 }
 [name=arrayOps]{margin-top:12px}
 span.error{color:#f0000c;background-color:#ff9e9e;display:block;width:100%}
diff --git a/plugins/dynamix/styles/default-gray.css b/plugins/dynamix/styles/default-gray.css
index 3c15e800f..b585a9bd7 100644
--- a/plugins/dynamix/styles/default-gray.css
+++ b/plugins/dynamix/styles/default-gray.css
@@ -225,14 +225,14 @@ table.share_status.dashboard.box3 tr td:nth-child(4){min-width:11%}
 table.share_status.dashboard.box3 tr td:nth-child(5){min-width:11%}
 table.share_status.dashboard.box3 tr td[colspan="4"]{min-width:93%}
 @media (max-width:1680px){
- table.share_status.dashboard.box1{width:44%}
- table.share_status.dashboard.box2{width:52%;float:right}
- table.share_status.dashboard.box3{width:52%;float:right}
+ table.share_status.dashboard.box1{width:45.4%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:53.4%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:53.4%;margin-left:0;margin-right:0;float:right}
 }
 @media (min-width:1681px){
- table.share_status.dashboard.box1{width:28%}
- table.share_status.dashboard.box2{width:34%;float:right}
- table.share_status.dashboard.box3{width:34%;margin-left:20px}
+ table.share_status.dashboard.box1{width:28.6%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:34.6%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:34.6%;margin-left:20px;margin-right:0}
 }
 tr.alert{color:#f0000c;background-color:#ff9e9e}
 tr.warn{color:#e68a00;background-color:#feefb3}
diff --git a/plugins/dynamix/styles/default-white.css b/plugins/dynamix/styles/default-white.css
index 44b0abd43..d5b8aa593 100644
--- a/plugins/dynamix/styles/default-white.css
+++ b/plugins/dynamix/styles/default-white.css
@@ -215,14 +215,14 @@ table.share_status.dashboard.box3 tr td:nth-child(4){min-width:11%}
 table.share_status.dashboard.box3 tr td:nth-child(5){min-width:11%}
 table.share_status.dashboard.box3 tr td[colspan="4"]{min-width:93%}
 @media (max-width:1680px){
- table.share_status.dashboard.box1{width:44%}
- table.share_status.dashboard.box2{width:52%;float:right}
- table.share_status.dashboard.box3{width:52%;float:right}
+ table.share_status.dashboard.box1{width:45.4%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:53.4%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:53.4%;margin-left:0;margin-right:0;float:right}
 }
 @media (min-width:1681px){
- table.share_status.dashboard.box1{width:28%}
- table.share_status.dashboard.box2{width:34%;float:right}
- table.share_status.dashboard.box3{width:34%;margin-left:20px}
+ table.share_status.dashboard.box1{width:28.6%;margin-left:0;margin-right:0;float:left}
+ table.share_status.dashboard.box2{width:34.6%;margin-left:0;margin-right:0;float:right}
+ table.share_status.dashboard.box3{width:34.6%;margin-left:22px;margin-right:0}
 }
 [name=arrayOps]{margin-top:12px}
 span.error{color:#f0000c;background-color:#ff9e9e;display:block;width:100%}

From c45ea69f7d99926413a428e713a935e165079859 Mon Sep 17 00:00:00 2001
From: bergware <bergware@users.noreply.github.com>
Date: Sun, 5 Jan 2020 10:41:19 +0100
Subject: [PATCH 2/4] Add user name and user description verification

---
 plugins/dynamix/UserAdd.page  | 7 +++----
 plugins/dynamix/UserEdit.page | 4 ++--
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/plugins/dynamix/UserAdd.page b/plugins/dynamix/UserAdd.page
index 6dd394ef1..f8aa912a1 100644
--- a/plugins/dynamix/UserAdd.page
+++ b/plugins/dynamix/UserAdd.page
@@ -122,16 +122,15 @@ $(function(){
 
 <form markdown="1" name="user_edit" method="POST" action="/update.htm" target="progressFrame" onsubmit="return checkUsername(this)">
 User name:
-: <input type="text" name="userName" maxlength="32" onKeyUp="this.form.cmdUserEdit.disabled=(this.form.userName.value=='')">
+: <input type="text" name="userName" maxlength="32" onKeyUp="this.form.cmdUserEdit.disabled=(this.form.userName.value=='')" pattern="^[a-z_][a-z0-9_-]*[$]?$">
 
 > Usernames may be up to 32 characters long and must start with a **lower case letter** or an underscore,
 > followed by **lower case letters**, digits, underscores, or dashes. They can end with a dollar sign.
-> In regular expression terms: `[a-z_][a-z0-9_-]*[$]?`
 
 Description:
-: <input type="text" name="userDesc" maxlength="64">
+: <input type="text" name="userDesc" maxlength="64" pattern='[^&:"]*'>
 
-> Up to 64 characters.
+> Up to 64 characters. The characters ampersand (&amp;) quote (&quot;) and colon (:) are not allowed.
 
 Custom image:
 : <span id="dropbox"><?=$void?></span><em>Drag-n-drop a PNG file or click the image at the left.</em><input type="file" id="drop" accept=".png" style="display:none">
diff --git a/plugins/dynamix/UserEdit.page b/plugins/dynamix/UserEdit.page
index 7aec7556f..bb469d18f 100644
--- a/plugins/dynamix/UserEdit.page
+++ b/plugins/dynamix/UserEdit.page
@@ -131,9 +131,9 @@ User name:
 : <?=htmlspecialchars($name)?>
 
 Description:
-: <input type="text" name="userDesc" maxlength="64" value="<?=htmlspecialchars($users[$name]['desc'])?>">
+: <input type="text" name="userDesc" maxlength="64" value="<?=htmlspecialchars($users[$name]['desc'])?>" pattern='[^&:"]*'>
 
-> Up to 64 characters.
+> Up to 64 characters. The characters ampersand (&amp;) quote (&quot;) and colon (:) are not allowed.
 
 Custom image:
 : <span id="dropbox">

From e1e835451d37fa93b8f665664f9b4a1b8916c460 Mon Sep 17 00:00:00 2001
From: bergware <bergware@users.noreply.github.com>
Date: Sun, 5 Jan 2020 15:06:26 +0100
Subject: [PATCH 3/4] Edit User: fix share access assignments

---
 plugins/dynamix/UserEdit.page | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/plugins/dynamix/UserEdit.page b/plugins/dynamix/UserEdit.page
index bb469d18f..804f4cf6f 100644
--- a/plugins/dynamix/UserEdit.page
+++ b/plugins/dynamix/UserEdit.page
@@ -184,12 +184,12 @@ foreach ($users as $user) {
 }
 foreach ($shares as $share => $data) {
   echo "security[\"$share\"]=\"{$sec[$share]['security']}\";\n";
-  echo "readList[\"$share\"]=\",{$sec[$share]['readList']},\";\n";
-  echo "writeList[\"$share\"]=\",{$sec[$share]['writeList']},\";\n";
+  echo "readList[\"$share\"]=\"{$sec[$share]['readList']}\";\n";
+  echo "writeList[\"$share\"]=\"{$sec[$share]['writeList']}\";\n";
 }
 ?>
 function updateAccess(form,data,n,i) {
-  var name = ",<?=$name?>,";
+  var name = "<?=$name?>";
   if (data) {
     if (n<i) {
       $.post('/update.htm',data[n], function(){setTimeout(function(){updateAccess(form,data,++n,i);},3000);});
@@ -203,6 +203,8 @@ function updateAccess(form,data,n,i) {
     $(form).find('select').each(function(){
       if ($(this).prop('id')) {
         var share = decodeURI($(this).prop('id'));
+        var read = readList[share].split(',');
+        var write = writeList[share].split(',');
         var access = '';
         data[i] = {};
         data[i]['shareName'] = share;
@@ -214,12 +216,12 @@ function updateAccess(form,data,n,i) {
             access = '<?=$rw?>';
             break;
           case 'secure':
-            if (','+user+',' == name) access = $(this).val();
-            else access = writeList[share].indexOf(name)!==-1 ? '<?=$rw?>' : '<?=$ro?>';
+            if (user == name) access = $(this).val();
+            else access = write.includes(user) ? '<?=$rw?>' : '<?=$ro?>';
             break;
           case 'private':
-            if (','+user+',' == name) access = $(this).val();
-            else access = writeList[share].indexOf(name)!==-1 ? '<?=$rw?>' : (readList[share].indexOf(name)!==-1 ? '<?=$ro?>' : '<?=$no?>');
+            if (user == name) access = $(this).val();
+            else access = write.includes(user) ? '<?=$rw?>' : (read.includes(user) ? '<?=$ro?>' : '<?=$no?>');
             break;
           }
           data[i]['userAccess.'+idx] = access;

From 4ec52d20e72f6d6e1ae6d3492ba7a2a3a980c647 Mon Sep 17 00:00:00 2001
From: bergware <bergware@users.noreply.github.com>
Date: Sun, 5 Jan 2020 18:24:59 +0100
Subject: [PATCH 4/4] Management page: remove UPnP conditional setting

---
 plugins/dynamix/ManagementAccess.page | 2 --
 1 file changed, 2 deletions(-)

diff --git a/plugins/dynamix/ManagementAccess.page b/plugins/dynamix/ManagementAccess.page
index dc5482245..cfe0ccd53 100644
--- a/plugins/dynamix/ManagementAccess.page
+++ b/plugins/dynamix/ManagementAccess.page
@@ -182,7 +182,6 @@ SSH port:
 
 > Enter the SSH port, default port is 22.
 
-<?if (file_exists('/var/log/plugins/dynamix.wireguard.plg')):?>
 Use UPnP:
 : <select name="USE_UPNP" size="1">
   <?=mk_option($var['USE_UPNP'], "yes", "Yes")?>
@@ -191,7 +190,6 @@ Use UPnP:
 
 > Enable (default) or disable the UPnP function on the server. This function allows automatic forwarding of ports on the router, only applicable when UPnP is enabled on the router itself.
 
-<?endif;?>
 Use SSL/TLS:
 : <select name="USE_SSL" size="1" onchange="updateSSL(this.form)">
   <?=mk_option($var['USE_SSL'], "auto", "Auto")?>