WLED/wled00/data/settings_sec.htm

<!DOCTYPE html>
<html lang="en">
<head>
	<meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" name="viewport">
	<meta charset="utf-8">
	<title>Misc Settings</title>
	<script src="common.js" async type="text/javascript"></script>
	<script>
		function U() { window.open(getURL("/update"),"_self"); }
		function checkNum(o) {
			const specialkeys = ["Backspace", "Tab", "Enter", "Shift", "Control", "Alt", "Pause", "CapsLock", "Escape", "Space", "PageUp", "PageDown", "End", "Home", "ArrowLeft", "ArrowUp", "ArrowRight", "ArrowDown", "Insert", "Delete"];
			// true if key is a number or a special key
			if(event.key.match(/[0-9]/) || specialkeys.includes(event.key)) return true;
			event.preventDefault();
			return false;
		}
		function setBckFilename(x) {
			x.setAttribute("download","wled_" + x.getAttribute("download") + (sd=="WLED"?"":("_" +sd)));
		}
		function S() {
			getLoc();
			if (loc) {
				gId("bckcfg").setAttribute('href',getURL(gId("bckcfg").pathname));
				gId("bckpresets").setAttribute('href',getURL(gId("bckpresets").pathname));
			}
			loadJS(getURL('/settings/s.js?p=6'), false, undefined, ()=>{
				setBckFilename(gId("bckcfg"));
				setBckFilename(gId("bckpresets"));
			});	// If we set async false, file is loaded and executed, then next statement is processed
			if (loc) d.Sf.action = getURL('/settings/sec');
		}
	</script>
	<style>
		@import url("style.css");
	</style>
</head>
<body onload="S()">
	<form id="form_s" name="Sf" method="post">
		<div class="toprow">
		<div class="helpB"><button type="button" onclick="H('features/settings/#security-settings')">?</button></div>
		<button type="button" onclick="B()">Back</button><button type="submit">Save</button><hr>
		</div>
		<h2>Security & Update setup</h2>
		Settings PIN: <input type="password" id="PIN" name="PIN" size="4" maxlength="4" minlength="4" onkeydown="checkNum(this)" pattern="[0-9]*" inputmode="numeric" title="Please enter a 4 digit number"><br>
		<div class="warn">&#9888; Unencrypted transmission. Be prudent when selecting PIN, do NOT use your banking, door, SIM, etc. pin!</div><br>
		Lock wireless (OTA) software update: <input type="checkbox" name="NO"><br>
		Passphrase: <input type="password" name="OP" maxlength="32"><br>
		To enable OTA, for security reasons you need to also enter the correct password!<br>
		The password should be changed when OTA is enabled.<br>
		<b>Disable OTA when not in use, otherwise an attacker can reflash device software!</b><br>
		<i>Settings on this page are only changable if OTA lock is disabled!</i><br>
		Deny access to WiFi settings if locked: <input type="checkbox" name="OW"><br><br>
		Factory reset: <input type="checkbox" name="RS"><br>
		All settings and presets will be erased.<br><br>
		<div class="warn">&#9888; Unencrypted transmission. An attacker on the same network can intercept form data!</div>
		<hr>
		<h3>Software Update</h3>
		<button type="button" onclick="U()">Manual OTA Update</button><br>
		<div id="aOTA">Enable ArduinoOTA: <input type="checkbox" name="AO"></div>
		Only allow update from same network/WiFi: <input type="checkbox" name="SU"><br>
		<i class="warn">&#9888; If you are using multiple VLANs (i.e. IoT or guest network) either set PIN or disable this option.<br>
			Disabling this option will make your device less secure.</i><br>
		<hr id="backup">
		<h3>Backup & Restore</h3>
		<div class="warn">&#9888; Restoring presets/configuration will OVERWRITE your current presets/configuration.<br>
		Incorrect upload or configuration may require a factory reset or re-flashing of your ESP.<br>
		For security reasons, passwords are not backed up.</div>
		<a class="btn lnk" id="bckcfg" href="/presets.json" download="presets">Backup presets</a><br>
		<div>Restore presets<br><input type="file" name="data" accept=".json"> <button type="button" onclick="uploadFile(d.Sf.data,'/presets.json');">Upload</button><br></div><br>
		<a class="btn lnk" id="bckpresets" href="/cfg.json" download="cfg">Backup configuration</a><br>
		<div>Restore configuration<br><input type="file" name="data2" accept=".json"> <button type="button" onclick="uploadFile(d.Sf.data2,'/cfg.json');">Upload</button><br></div>
		<hr>
		<h3>About</h3>
		<a href="https://github.com/wled-dev/WLED/" target="_blank">WLED</a>&#32;version ##VERSION##<!-- Autoreplaced from package.json --><br><br>
		<a href="https://kno.wled.ge/about/contributors/" target="_blank">Contributors, dependencies and special thanks</a><br>
		A huge thank you to everyone who helped me create WLED!<br><br>
		(c) 2016-2024 Christian Schwinne <br>
		<i>Licensed under the <a href="https://github.com/wled-dev/WLED/blob/main/LICENSE" target="_blank">EUPL v1.2 license</a></i><br><br>
		Server message: <span class="sip"> Response error! </span><hr>
		<div id="toast"></div>
		<button type="button" onclick="B()">Back</button><button type="submit">Save</button>
	</form>
</body>
</html>
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<!DOCTYPE html>`
added lang attribute to the html start tag 2020-12-23 20:43:30 +00:00			`<html lang="en">`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<head>`
$Mountain/\Ash$ Fix: removing duplicate `viewport` declaration - removed unneeded self-closing slash 2023-10-04 19:37:10 +00:00			`<meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" name="viewport">`
Sync htm and fix js errors 2020-05-17 19:39:57 +00:00			`<meta charset="utf-8">`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<title>Misc Settings</title>`
Introduce common.js in settings pages 2024-09-17 14:26:11 +00:00			`<script src="common.js" async type="text/javascript"></script>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<script>`
Reverse proxy support. 2023-06-04 16:40:29 +00:00			`function U() { window.open(getURL("/update"),"_self"); }`
Added: - generic settings.js handler - update info - numeric (not really) hidden PIN 2022-03-02 14:41:31 +00:00			`function checkNum(o) {`
Bugfixes. - prevent changing main segment during live - PIN code entry validation - UI CSS fixes 2022-04-07 19:54:55 +00:00			`const specialkeys = ["Backspace", "Tab", "Enter", "Shift", "Control", "Alt", "Pause", "CapsLock", "Escape", "Space", "PageUp", "PageDown", "End", "Home", "ArrowLeft", "ArrowUp", "ArrowRight", "ArrowDown", "Insert", "Delete"];`
			`// true if key is a number or a special key`
			`if(event.key.match(/[0-9]/) \|\| specialkeys.includes(event.key)) return true;`
Added: - generic settings.js handler - update info - numeric (not really) hidden PIN 2022-03-02 14:41:31 +00:00			`event.preventDefault();`
			`return false;`
			`}`
Preset and config backups include server description 2022-08-05 10:09:13 +00:00			`function setBckFilename(x) {`
			`x.setAttribute("download","wled_" + x.getAttribute("download") + (sd=="WLED"?"":("_" +sd)));`
			`}`
Vectors & dynamic loadJS. - Segments - Modes NOTE: crashes ESP if effect is running while deleting segment. 2022-07-17 13:58:41 +00:00			`function S() {`
Introduce common.js in settings pages 2024-09-17 14:26:11 +00:00			`getLoc();`
Bugfix download backup json 2023-06-08 07:41:38 +00:00			`if (loc) {`
			`gId("bckcfg").setAttribute('href',getURL(gId("bckcfg").pathname));`
			`gId("bckpresets").setAttribute('href',getURL(gId("bckpresets").pathname));`
			`}`
Introduce common.js in settings pages 2024-09-17 14:26:11 +00:00			`loadJS(getURL('/settings/s.js?p=6'), false, undefined, ()=>{`
			`setBckFilename(gId("bckcfg"));`
			`setBckFilename(gId("bckpresets"));`
			`}); // If we set async false, file is loaded and executed, then next statement is processed`
Reverse proxy support. 2023-06-04 16:40:29 +00:00			`if (loc) d.Sf.action = getURL('/settings/sec');`
			`}`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`</script>`
			`<style>`
Minor changes to auto UI code generation Replace outdated CSS in HTML by style.css import Fix missing button double press in time settings FIx missing meta utf-8 in WiFi and UI settings Modify cdata.js to add an info header to the top of auto-generated files 2020-06-10 10:45:44 +00:00			`@import url("style.css");`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`</style>`
			`</head>`
Vectors & dynamic loadJS. - Segments - Modes NOTE: crashes ESP if effect is running while deleting segment. 2022-07-17 13:58:41 +00:00			`<body onload="S()">`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<form id="form_s" name="Sf" method="post">`
Sticky save & back buttons. 2021-03-05 08:50:59 +00:00			`<div class="toprow">`
Introduce common.js in settings pages 2024-09-17 14:26:11 +00:00			`<div class="helpB"><button type="button" onclick="H('features/settings/#security-settings')">?</button></div>`
Settings PIN protection. 2022-03-01 22:37:28 +00:00			`<button type="button" onclick="B()">Back</button><button type="submit">Save</button><hr>`
Sticky save & back buttons. 2021-03-05 08:50:59 +00:00			`</div>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<h2>Security & Update setup</h2>`
Bugfixes. - prevent changing main segment during live - PIN code entry validation - UI CSS fixes 2022-04-07 19:54:55 +00:00			`Settings PIN: <input type="password" id="PIN" name="PIN" size="4" maxlength="4" minlength="4" onkeydown="checkNum(this)" pattern="[0-9]*" inputmode="numeric" title="Please enter a 4 digit number"><br>`
Beta-3 changes - remove I2C init from usermods - PCF8574 (&co) port expander support - refactor PIR & Rotary encoder & 4LD - reboot race condition - optimisations 2023-05-30 17:36:14 +00:00			`<div class="warn">⚠ Unencrypted transmission. Be prudent when selecting PIN, do NOT use your banking, door, SIM, etc. pin!</div><br>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`Lock wireless (OTA) software update: <input type="checkbox" name="NO"><br>`
			`Passphrase: <input type="password" name="OP" maxlength="32"><br>`
			`To enable OTA, for security reasons you need to also enter the correct password!<br>`
			`The password should be changed when OTA is enabled.<br>`
			`<b>Disable OTA when not in use, otherwise an attacker can reflash device software!</b><br>`
			`<i>Settings on this page are only changable if OTA lock is disabled!</i><br>`
			`Deny access to WiFi settings if locked: <input type="checkbox" name="OW"><br><br>`
			`Factory reset: <input type="checkbox" name="RS"><br>`
Added ability to add multiple busses as compile time defaults using the esp32_multistrip usermod define syntax 2021-04-15 08:55:22 +00:00			`All settings and presets will be erased.<br><br>`
Beta-3 changes - remove I2C init from usermods - PCF8574 (&co) port expander support - refactor PIR & Rotary encoder & 4LD - reboot race condition - optimisations 2023-05-30 17:36:14 +00:00			`<div class="warn">⚠ Unencrypted transmission. An attacker on the same network can intercept form data!</div>`
Merge branch 'master' into dev 2021-08-19 19:57:04 +00:00			`<hr>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<h3>Software Update</h3>`
			`<button type="button" onclick="U()">Manual OTA Update</button><br>`
Add UI logic to hide ArduinoOTA checkbox and remove configuration items 2025-04-20 09:44:26 +00:00			`<div id="aOTA">Enable ArduinoOTA: <input type="checkbox" name="AO"></div>`
Securing OTA update - prevent settings change if not using private IP address or same subnet - prevent OTA from differnet subnet if PIN is not set - ability to revert firmware 2025-05-26 16:00:45 +00:00			`Only allow update from same network/WiFi: <input type="checkbox" name="SU"><br>`
			`<i class="warn">⚠ If you are using multiple VLANs (i.e. IoT or guest network) either set PIN or disable this option.<br>`
			`Disabling this option will make your device less secure.</i><br>`
simpler hight FPS warning * removed "use 0 for unlimited" * added "high FPS mode is experimental" warning * added "backup first!" warning * added anchor #backup to sec page 2024-11-06 21:09:33 +00:00			`<hr id="backup">`
Added missing ir.json error type. Hopefully fix for WS virtual disconnects. WS debugging info. 2021-07-25 20:44:26 +00:00			`<h3>Backup & Restore</h3>`
Reposition upload warning message. Fixes #3778 2024-02-27 14:59:41 +00:00			`<div class="warn">⚠ Restoring presets/configuration will OVERWRITE your current presets/configuration.<br>`
Update settings_sec.htm 2024-11-26 16:33:22 +00:00			`Incorrect upload or configuration may require a factory reset or re-flashing of your ESP.<br>`
			`For security reasons, passwords are not backed up.</div>`
Preset and config backups include server description 2022-08-05 10:09:13 +00:00			`<a class="btn lnk" id="bckcfg" href="/presets.json" download="presets">Backup presets</a><br>`
Arduino OTA lock fix. 2022-05-01 20:09:40 +00:00			`<div>Restore presets<br><input type="file" name="data" accept=".json"> <button type="button" onclick="uploadFile(d.Sf.data,'/presets.json');">Upload</button><br></div><br>`
Preset and config backups include server description 2022-08-05 10:09:13 +00:00			`<a class="btn lnk" id="bckpresets" href="/cfg.json" download="cfg">Backup configuration</a><br>`
Arduino OTA lock fix. 2022-05-01 20:09:40 +00:00			`<div>Restore configuration<br><input type="file" name="data2" accept=".json"> <button type="button" onclick="uploadFile(d.Sf.data2,'/cfg.json');">Upload</button><br></div>`
Settings PIN protection. 2022-03-01 22:37:28 +00:00			`<hr>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`<h3>About</h3>`
update links to point to the new repo 2025-02-15 19:07:41 +00:00			`<a href="https://github.com/wled-dev/WLED/" target="_blank">WLED</a> version ##VERSION##<!-- Autoreplaced from package.json --><br><br>`
			`<a href="https://kno.wled.ge/about/contributors/" target="_blank">Contributors, dependencies and special thanks</a><br>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`A huge thank you to everyone who helped me create WLED!<br><br>`
Fix expanded preset low width Fix spaces missing in HTML somehow Update copyright year 2024-03-10 20:52:54 +00:00			`(c) 2016-2024 Christian Schwinne <br>`
update links to point to the new repo 2025-02-15 19:07:41 +00:00			`<i>Licensed under the <a href="https://github.com/wled-dev/WLED/blob/main/LICENSE" target="_blank">EUPL v1.2 license</a></i><br><br>`
New web UI features 2020-05-01 23:59:41 +00:00			`Server message: <span class="sip"> Response error! </span><hr>`
Backup/restore presets & holiday array upload. Reduced number of segments on 8266. 2021-07-14 21:10:19 +00:00			`<div id="toast"></div>`
Settings PIN protection. 2022-03-01 22:37:28 +00:00			`<button type="button" onclick="B()">Back</button><button type="submit">Save</button>`
Converted UTF-16 files with UTF-8 and CR/LF to LF. 2019-11-27 21:28:13 +00:00			`</form>`
			`</body>`
Update settings_sec.htm 2024-11-26 16:33:22 +00:00			`</html>`