Map and Rx Packets fixes and security updates

Fix stored XSS in received packet rendering

.github/workflows/commit.yml

@@ -15,11 +15,11 @@ jobs:
                 - name: ttgo-lora32-v21
                   chip: esp32
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v7
 
-            - uses: actions/setup-python@v4
+            - uses: actions/setup-python@v7
               with:
-                  python-version: "3.9"
+                  python-version: "3.13"
 
             - name: Install PlatformIO Core
               run: pip install --upgrade platformio

data_embed/index.html

@@ -62,6 +62,12 @@ body{background:var(--msh-bg);color:var(--msh-text);font-family:"Inter",system-u
 #received-packets .table{--bs-table-color:var(--msh-text);--bs-table-border-color:var(--msh-border);color:var(--msh-text);}
 #received-packets th{white-space:nowrap;}
 #received-packets td:nth-child(1),#received-packets td:nth-child(2),#received-packets td:nth-child(4),#received-packets td:nth-child(5){white-space:nowrap;}
+#received-packets th:nth-child(1){width:calc(10ch + 1rem);min-width:calc(10ch + 1rem);}
+#received-packets th:nth-child(2){width:calc(8ch + 1rem);min-width:calc(8ch + 1rem);}
+#received-packets th:nth-child(4){width:calc(4ch + 1rem);min-width:calc(4ch + 1rem);}
+#received-packets th:nth-child(5){width:calc(6ch + 1rem);min-width:calc(6ch + 1rem);}
+#received-packets td:nth-child(1),#received-packets td:nth-child(2),#received-packets td:nth-child(4),#received-packets td:nth-child(5){font-variant-numeric:tabular-nums;}
+#received-packets td:nth-child(3){overflow-wrap:anywhere;}
 @media(max-width:768px){.app-sidebar{width:60px;padding:12px 6px;}.side-link .label,.nav-group-label{display:none;}.app-main{padding:14px;}}
 </style>
 </head>
@@ -198,7 +204,7 @@ body{background:var(--msh-bg);color:var(--msh-text);font-family:"Inter",system-u
                                 <tr>
                                     <th scope="col">Date</th>
                                     <th scope="col">Time</th>
-                                    <th scope="col">Frame</th>
+                                    <th scope="col">Packet</th>
                                     <th scope="col">RSSI</th>
                                     <th scope="col">SNR</th>
                                 </tr>

data_embed/script.js

@@ -606,13 +606,11 @@ function loadReceivedPackets(packets) {
         packets.forEach((packet) => {
             const element = document.createElement("tr");
 
-            element.innerHTML = `
-                        <td>${packet.rxDate}</td>
-                        <td>${packet.rxTime}</td>
-                        <td>${packet.packet}</td>
-                        <td>${packet.RSSI}</td>
-                        <td>${packet.SNR}</td>
-                    `;
+            ['rxDate', 'rxTime', 'packet', 'RSSI', 'SNR'].forEach((field) => {
+                const cell = document.createElement("td");
+                cell.textContent = String(packet[field]);
+                element.appendChild(cell);
+            });
 
             container.appendChild(element);
         })
@@ -655,6 +653,15 @@ let mapTileErrShown = false;
 let iGateLatLng    = null;
 let mapAutoFitDone = false;
 
+function escapeHtml(value) {    // shows received data as text inside HTML strings (map popups / icons)
+    return String(value ?? "")
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+
 function setMapMessage(text) {
     const el = document.getElementById("map");
     if (el) {
@@ -833,7 +840,7 @@ function getAprsSymbolIcon(symbol, callsign = "") {
                         -1px  1px 0 #fff,
                          1px  1px 0 #fff;
                     pointer-events:none;
-                ">${callsign}</span>
+                ">${escapeHtml(callsign)}</span>
             </div>
         `,
         iconSize: [24, 24],
@@ -935,12 +942,12 @@ function loadMapStations(stations) {
     (stations || []).forEach((s) => {
         if (s.lat === 0 && s.lon === 0) return;     // descartar estaciones sin fix
 
-        const popup = `<b>${s.callsign}</b>`
-            + (s.lastHeard ? `<br>Last: ${s.lastHeard}` : "")
+        const popup = `<b>${escapeHtml(s.callsign)}</b>`
+            + (s.lastHeard ? `<br>Last: ${escapeHtml(s.lastHeard)}` : "")
             + `<br>RSSI ${s.RSSI} / SNR ${s.SNR}`
             + `<br>Packets: ${s.count}`
-            + `<br><b>${describeMapPath(s)}</b>`
-            + (s.path ? `<br><small>Path: ${s.path}</small>` : "");
+            + `<br><b>${escapeHtml(describeMapPath(s))}</b>`
+            + (s.path ? `<br><small>Path: ${escapeHtml(s.path)}</small>` : "");
 
         const aprsIcon =
             getAprsSymbolIcon(s.symbol, s.callsign);
@@ -1172,4 +1179,4 @@ form.addEventListener("invalid", function (event) {
             el.scrollIntoView({ block: "center", behavior: "smooth" });
         }, 0);
     }
-}, true);
+}, true);

include/network_manager.h

@@ -43,9 +43,12 @@ private:
 
     String _hostName = "";
     std::vector<WiFiNetwork> _wifiNetworks;
+    volatile uint8_t _lastWiFiDisconnectReason = 0;
+    String _wifiAuthFailSSID = "";
 
     int _findWiFiNetworkIndex(const String& ssid) const;
     bool _connectWiFi(const WiFiNetwork& network);
+    bool _isWiFiAuthFailure() const;
     void _processAPTimeout();
     void _onNetworkEvent(arduino_event_id_t event, arduino_event_info_t /*info*/);
 
@@ -75,6 +78,7 @@ public:
     bool disconnectWiFi();
     String getWiFiSSID() const;
     String getWiFiAPSSID() const;
+    String getWiFiAuthFailSSID() const;
     IPAddress getWiFiIP() const;
     IPAddress getWiFiAPIP() const;
     wifi_mode_t getWiFiMode() const;

src/LoRa_APRS_iGate.cpp

@@ -68,7 +68,7 @@ ___________________________________________________________________*/
 #endif
 
 
-String              versionDate             = "2026-09-30";
+String              versionDate             = "2026-10-02";
 String              versionNumber           = "4.0.2";
 Configuration       Config;
 WiFiClient          aprsIsClient;

src/network_manager.cpp

@@ -51,12 +51,14 @@ bool NetworkManager::_connectWiFi(const WiFiNetwork& network) {
     WiFi.mode(_wifiAPmode ? WIFI_AP_STA : WIFI_STA);
 
     Serial.println("[NM] Attempting to connect to WiFi: " + network.ssid);
+    _lastWiFiDisconnectReason = 0;
     WiFi.begin(network.ssid.c_str(), network.psk.c_str());
 
     Serial.print("[NM] Connecting ");
 
     int attempts = 0;
     while (!isWiFiConnected() && attempts < 10) {
+        if (_lastWiFiDisconnectReason == WIFI_REASON_AUTH_FAIL) break;
         delay(500);
         #ifdef INTERNAL_LED_PIN
             digitalWrite(INTERNAL_LED_PIN,HIGH);
@@ -72,10 +74,19 @@ bool NetworkManager::_connectWiFi(const WiFiNetwork& network) {
 
     if (isWiFiConnected()) return true;
 
+    if (_isWiFiAuthFailure()) {
+        Serial.println("[NM] Wrong WiFi password for SSID: " + network.ssid);
+        if (_wifiAuthFailSSID.isEmpty()) _wifiAuthFailSSID = network.ssid;
+    }
     Serial.println("[NM] Failed to connect to WiFi after " + String(attempts) + " attempts. SSID: " + network.ssid);
     return false;
 }
 
+bool NetworkManager::_isWiFiAuthFailure() const {
+    uint8_t reason = _lastWiFiDisconnectReason;
+    return reason == WIFI_REASON_AUTH_FAIL || reason == WIFI_REASON_4WAY_HANDSHAKE_TIMEOUT || reason == WIFI_REASON_HANDSHAKE_TIMEOUT;
+}
+
 void NetworkManager::_processAPTimeout() {
     if (!_wifiAPmode || _apTimeout == 0) {
         return;
@@ -93,8 +104,11 @@ void NetworkManager::_processAPTimeout() {
     }
 }
 
-void NetworkManager::_onNetworkEvent(arduino_event_id_t event, arduino_event_info_t /*info*/) {
+void NetworkManager::_onNetworkEvent(arduino_event_id_t event, arduino_event_info_t info) {
     switch (event) {
+        case ARDUINO_EVENT_WIFI_STA_DISCONNECTED:
+            _lastWiFiDisconnectReason = info.wifi_sta_disconnected.reason;
+            break;
         case ARDUINO_EVENT_ETH_START:
             Serial.println("[NM] ETH Started");
             if (!_hostName.isEmpty()) {
@@ -224,6 +238,7 @@ bool NetworkManager::connectWiFi() {
     if (_wifiNetworks.empty()) {
         return false;
     }
+    _wifiAuthFailSSID = "";
 
     for (size_t i = 0; i < _wifiNetworks.size(); i++) {
         disconnectWiFi();
@@ -256,6 +271,10 @@ String NetworkManager::getWiFiAPSSID() const {
     return WiFi.softAPSSID();
 }
 
+String NetworkManager::getWiFiAuthFailSSID() const {
+    return _wifiAuthFailSSID;
+}
+
 IPAddress NetworkManager::getWiFiIP() const {
     return WiFi.localIP();
 }

src/wifi_utils.cpp

@@ -34,6 +34,7 @@ extern uint32_t         lastServerCheck;
 uint8_t     wifiCounter         = 0;
 uint32_t    lastBackupDigiTime  = millis();
 uint32_t    lastWiFiCheck       = 0;
+bool        firstWiFiAttempt    = true;
 
 
 namespace WIFI_Utils {
@@ -108,6 +109,8 @@ namespace WIFI_Utils {
 
         displayShow("", "Connecting to WiFi:", "", "     loading ...", 0);
         networkManager->connectWiFi();
+        bool showAuthError = firstWiFiAttempt;
+        firstWiFiAttempt = false;
 
         #ifdef INTERNAL_LED_PIN
             digitalWrite(INTERNAL_LED_PIN, LOW);
@@ -120,6 +123,10 @@ namespace WIFI_Utils {
             displayShow("", "     Connected!!", "" , "     loading ...", 1000);
         } else {
             Serial.println("[WiFi] Not connected to WiFi!");
+            String authFailSSID = networkManager->getWiFiAuthFailSSID();
+            if (showAuthError && !authFailSSID.isEmpty()) {
+                displayShow("", "SSID: " + authFailSSID.substring(0, 15), "Bad WiFi password", "Double check settings", 5000);
+            }
             if (Config.wifiAutoAP.enabled) {
                 Serial.println("Starting AP fallback...");
                 displayShow("", " WiFi Not Connected!", "" , "     loading ...", 1000);