[pwsh]

Description:

The message box of the main WebUI page had two problems.

Layout. The box had a fixed height (height:7.5em, white-space: pre), and the live message (/?m=1) always contained the title plus 4 lines, empty ones included. The box therefore showed blank rows and didn't fit its content. Now only the lines in use are sent, and the box fits and wraps its content (white-space: pre-wrap, no fixed height). This applies to every module.

LoRa messages. The LORAtoMQTT case only handled tempc, hum and adc, and wrote the adc line into line2, overwriting the humidity. Every other LoRa message (hex packets, text, decoded devices, the gateway LoRa configuration message) showed only its title. It now shows:

• the sender (name or id, with the model)
• the data fields (temperature still follows the °C/°F setting)
• the radio information (rssi, snr, fcnt)
• for the gateway configuration message: frequency, SF, bandwidth, sync word and TX power

Built ttgo-lora32-v21 and esp32dev-all-test with no warnings. Tested on a LilyGo LoRa32 V2.1:

• The box shows the LoRa configuration on 4 lines and one-line messages (uptime) on one line.
• Messages from a LoRa sensor show the sender, its fields and the radio information.

Checklist:

• The pull request is done against the latest development branch
• Only one feature/fix was added per PR and the code change compiles without warnings
• I accept the DCO.

🤖 Generated with Claude Code

[1technophile]

Tested this revision on a connected M5Stack Core (ESP32, 4 MiB flash). The standard PR firmware built, booted, connected to Wi-Fi, and served the authenticated home, message, and information pages successfully. Automatic message-box height and wrapping worked.

For the LoRa display checks, a temporary test adapter enabled the unchanged LoRa formatter without a radio and injected sample messages on the physical ESP32. The real HTTP responses were checked, along with browser rendering. This validates formatting, not LoRa RF reception; MQTT and live BLE reception were not validated.

10 of 13 formatting checks passed, including empty-row removal, LoRa configuration display, temperature conversion, humidity plus ADC, short hex, and escaped message text. The three failing cases identify two issues that should be fixed before merging: unescaped sender fields allow HTML injection, and an oversized data field suppresses itself and subsequent fields. Details and reproductions are inline.

Please escape all sender fields and handle oversized values without abandoning the remaining fields, then rerun these cases.

[1technophile]

[P1] Escape sender fields before inserting them into the WebUI HTML. The new name/id/model values are copied into line1 without the escaping applied to data items below. On the physical ESP32, injecting {"name":"sensor","tempc":20,"rssi":-60,"snr":9} returned the literal sensor in /?m=1, and the browser interpreted it as markup. Since the page inserts this response using innerHTML, untrusted sender fields create an HTML-injection path. Escape name, id, and model before rendering them, and add coverage showing that HTML-like sender values remain literal text.

[1technophile]

[P2] Do not abandon all remaining fields when one value exceeds the line buffer. This break exits the entire JSON-field loop. On the physical ESP32, an 80-byte hex packet ("AB" repeated 80 times) displayed only the title and radio metadata, with no payload. A message of 140 characters followed by tempc and hum also hid both sensor fields. Please truncate or split oversized values with a visible indication, or at least skip only that field and continue processing subsequent fields. Cover both a long hex payload and an oversized first field followed by short sensor values.