adminui: the enrolment link was rendered as a dead anchor

html/template rewrites an href whose scheme it does not recognise to "#ZgotmplZ". echolot:// is not on its list, so "Open in the Echolot app" was not a link at all — tapping it did nothing, and nothing showed it: the markup reads correctly, the app resolves the scheme, and only the sanitised attribute in the served HTML gives it away. Marking the value template.URL opts out of that sanitising, which is only safe because the shape is now checked first. The link arrives in a query parameter, so without the check a crafted /devices?link=javascript:… would put a script URL into the page for an admin to click. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-02 08:04:56 +02:00
parent f6e093944c
commit 33799b8135
2 changed files with 16 additions and 2 deletions
@@ -327,7 +327,7 @@ const baseHTML = `<!doctype html>
    <!-- On the phone being enrolled this is the whole procedure: the scheme is registered by the
         app, so following the link hands it the token directly. Copying a 200-character string
         between two devices is the step that goes wrong, and it does not have to happen at all. -->
-    <p><a class="btn" href="{{.}}">Open in the Echolot app</a></p>
+    {{with $.LinkHref}}<p><a class="btn" href="{{.}}">Open in the Echolot app</a></p>{{end}}
    <p class="muted">Only works on the phone you are enrolling. From anywhere else, copy the link
      into the app's enrolment field, or deliver it over adb.</p>
    <p><code>{{.}}</code></p>