Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion emhttp/plugins/dynamix/DashStats.page
Original file line number Diff line number Diff line change
Expand Up @@ -804,10 +804,23 @@ switch ($themeHelper->getThemeName()) { // $themeHelper set in DefaultPageLayout
<?
$label = $value = [];
$i = 0;
// optional custom fan names, keyed by "<chip> - <fanN>" (matches `sensors -uA` order)
$fan_names_file = '/boot/config/plugins/dynamix/fan_names.json';
$fan_names = file_exists($fan_names_file) ? (json_decode(file_get_contents($fan_names_file), true) ?: []) : [];
$fan_keys = [];
$fan_chip = '';
foreach (explode("\n", shell_exec("sensors -uA 2>/dev/null") ?: '') as $fan_line) {
if (strpos($fan_line, ':') === false && trim($fan_line) !== '') {
$fan_chip = trim($fan_line);
} elseif (preg_match('/^\s*(fan\d+)_input:/', $fan_line, $fan_m)) {
$fan_keys[] = "$fan_chip - {$fan_m[1]}";
}
}
for ($fan=0; $fan<$fans; $fan++) {
if ($fan > 0 && $fan % 3 == 0) $i++;
$class = $fan % 3 == 2 ? "" : " class='fan'";
$label[$i][] = "<span{$class}>"._('FAN')." ".($fan+1)."</span>";
$fan_label = (($fan_names[$fan_keys[$fan] ?? ''] ?? '') !== '') ? htmlspecialchars($fan_names[$fan_keys[$fan]]) : _('FAN')." ".($fan+1);
$label[$i][] = "<span{$class}>$fan_label</span>";
Comment on lines +809 to +823

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate custom fan-name type before escaping.

At Line 813, non-string JSON values can pass the !== '' check and then reach htmlspecialchars(...), which can trigger runtime errors and break Airflow tile rendering for malformed fan_names.json.

Suggested fix
-$fan_names = file_exists($fan_names_file) ? (json_decode(file_get_contents($fan_names_file), true) ?: []) : [];
+$fan_names = file_exists($fan_names_file) ? json_decode(file_get_contents($fan_names_file), true) : [];
+if (!is_array($fan_names)) $fan_names = [];
 ...
-    $fan_label = ($fan_names[$fan] ?? '') !== '' ? htmlspecialchars($fan_names[$fan]) : _('FAN')." ".($fan+1);
+    $custom_name = $fan_names[$fan] ?? null;
+    $fan_label = (is_string($custom_name) && trim($custom_name) !== '')
+      ? htmlspecialchars($custom_name)
+      : _('FAN')." ".($fan+1);
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
$fan_names = file_exists($fan_names_file) ? (json_decode(file_get_contents($fan_names_file), true) ?: []) : [];
for ($fan=0; $fan<$fans; $fan++) {
if ($fan > 0 && $fan % 3 == 0) $i++;
$class = $fan % 3 == 2 ? "" : " class='fan'";
$label[$i][] = "<span{$class}>"._('FAN')." ".($fan+1)."</span>";
$fan_label = ($fan_names[$fan] ?? '') !== '' ? htmlspecialchars($fan_names[$fan]) : _('FAN')." ".($fan+1);
$label[$i][] = "<span{$class}>$fan_label</span>";
$fan_names = file_exists($fan_names_file) ? json_decode(file_get_contents($fan_names_file), true) : [];
if (!is_array($fan_names)) $fan_names = [];
for ($fan=0; $fan<$fans; $fan++) {
if ($fan > 0 && $fan % 3 == 0) $i++;
$class = $fan % 3 == 2 ? "" : " class='fan'";
$custom_name = $fan_names[$fan] ?? null;
$fan_label = (is_string($custom_name) && trim($custom_name) !== '')
? htmlspecialchars($custom_name)
: _('FAN')." ".($fan+1);
$label[$i][] = "<span{$class}>$fan_label</span>";
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@emhttp/plugins/dynamix/DashStats.page` around lines 809 - 814, The code uses
$fan_names[$fan] without ensuring it's a string before calling htmlspecialchars,
which can cause runtime errors for non-string JSON values; update the logic
around $fan_label in the loop (the handling that reads $fan_names_file,
$fan_names and assigns $fan_label) to first validate the value is a non-empty
string (e.g. is_string($fan_names[$fan]) && $fan_names[$fan] !== '') and only
then call htmlspecialchars on it, otherwise fall back to the default _('FAN')."
".($fan+1); ensure the check replaces the current !== '' test so malformed
fan_names.json entries won't reach htmlspecialchars.

}
$i = 0;
for ($fan=0; $fan<$fans; $fan++) {
Expand Down