Map and Rx Packets fixes and security updates

Fix stored XSS in received packet rendering

data_embed/index.html

@@ -62,6 +62,12 @@ body{background:var(--msh-bg);color:var(--msh-text);font-family:"Inter",system-u
 #received-packets .table{--bs-table-color:var(--msh-text);--bs-table-border-color:var(--msh-border);color:var(--msh-text);}
 #received-packets th{white-space:nowrap;}
 #received-packets td:nth-child(1),#received-packets td:nth-child(2),#received-packets td:nth-child(4),#received-packets td:nth-child(5){white-space:nowrap;}
+#received-packets th:nth-child(1){width:calc(10ch + 1rem);min-width:calc(10ch + 1rem);}
+#received-packets th:nth-child(2){width:calc(8ch + 1rem);min-width:calc(8ch + 1rem);}
+#received-packets th:nth-child(4){width:calc(4ch + 1rem);min-width:calc(4ch + 1rem);}
+#received-packets th:nth-child(5){width:calc(6ch + 1rem);min-width:calc(6ch + 1rem);}
+#received-packets td:nth-child(1),#received-packets td:nth-child(2),#received-packets td:nth-child(4),#received-packets td:nth-child(5){font-variant-numeric:tabular-nums;}
+#received-packets td:nth-child(3){overflow-wrap:anywhere;}
 @media(max-width:768px){.app-sidebar{width:60px;padding:12px 6px;}.side-link .label,.nav-group-label{display:none;}.app-main{padding:14px;}}
 </style>
 </head>
@@ -198,7 +204,7 @@ body{background:var(--msh-bg);color:var(--msh-text);font-family:"Inter",system-u
                                 <tr>
                                     <th scope="col">Date</th>
                                     <th scope="col">Time</th>
-                                    <th scope="col">Frame</th>
+                                    <th scope="col">Packet</th>
                                     <th scope="col">RSSI</th>
                                     <th scope="col">SNR</th>
                                 </tr>

data_embed/script.js

@@ -606,13 +606,11 @@ function loadReceivedPackets(packets) {
         packets.forEach((packet) => {
             const element = document.createElement("tr");
 
-            element.innerHTML = `
-                        <td>${packet.rxDate}</td>
-                        <td>${packet.rxTime}</td>
-                        <td>${packet.packet}</td>
-                        <td>${packet.RSSI}</td>
-                        <td>${packet.SNR}</td>
-                    `;
+            ['rxDate', 'rxTime', 'packet', 'RSSI', 'SNR'].forEach((field) => {
+                const cell = document.createElement("td");
+                cell.textContent = String(packet[field]);
+                element.appendChild(cell);
+            });
 
             container.appendChild(element);
         })
@@ -655,6 +653,15 @@ let mapTileErrShown = false;
 let iGateLatLng    = null;
 let mapAutoFitDone = false;
 
+function escapeHtml(value) {    // shows received data as text inside HTML strings (map popups / icons)
+    return String(value ?? "")
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+
 function setMapMessage(text) {
     const el = document.getElementById("map");
     if (el) {
@@ -833,7 +840,7 @@ function getAprsSymbolIcon(symbol, callsign = "") {
                         -1px  1px 0 #fff,
                          1px  1px 0 #fff;
                     pointer-events:none;
-                ">${callsign}</span>
+                ">${escapeHtml(callsign)}</span>
             </div>
         `,
         iconSize: [24, 24],
@@ -935,12 +942,12 @@ function loadMapStations(stations) {
     (stations || []).forEach((s) => {
         if (s.lat === 0 && s.lon === 0) return;     // descartar estaciones sin fix
 
-        const popup = `<b>${s.callsign}</b>`
-            + (s.lastHeard ? `<br>Last: ${s.lastHeard}` : "")
+        const popup = `<b>${escapeHtml(s.callsign)}</b>`
+            + (s.lastHeard ? `<br>Last: ${escapeHtml(s.lastHeard)}` : "")
             + `<br>RSSI ${s.RSSI} / SNR ${s.SNR}`
             + `<br>Packets: ${s.count}`
-            + `<br><b>${describeMapPath(s)}</b>`
-            + (s.path ? `<br><small>Path: ${s.path}</small>` : "");
+            + `<br><b>${escapeHtml(describeMapPath(s))}</b>`
+            + (s.path ? `<br><small>Path: ${escapeHtml(s.path)}</small>` : "");
 
         const aprsIcon =
             getAprsSymbolIcon(s.symbol, s.callsign);
@@ -1172,4 +1179,4 @@ form.addEventListener("invalid", function (event) {
             el.scrollIntoView({ block: "center", behavior: "smooth" });
         }, 0);
     }
-}, true);
+}, true);

src/LoRa_APRS_iGate.cpp

@@ -68,7 +68,7 @@ ___________________________________________________________________*/
 #endif
 
 
-String              versionDate             = "2026-10-01";
+String              versionDate             = "2026-10-02";
 String              versionNumber           = "4.0.2";
 Configuration       Config;
 WiFiClient          aprsIsClient;