pfSense

the described behavior is also present in the current version of pfSense+ as well (24.03)

I just noticed that the widget needs also a patch to display server description when wol is sent using the widget.
Should it be done on distinct commit than this ?

Both could be on the same PR since they're for the same issue, but the PR needs work anyhow -- I left a comment on there.

It's helpful to use Git to squash the commits so they only appear as one commit in the PR, but not a hard requirement in most cases.

Jim Pingle wrote in #note-8:

Both could be on the same PR since they're for the same issue, but the PR needs work anyhow -- I left a comment on there.

It's helpful to use Git to squash the commits so they only appear as one commit in the PR, but not a hard requirement in most cases.

Is it ok if I use hmtlspecialchars() instead, as I should've done from start in fact ? It'll make it safe in that case
Or you prefer the check from config entries ?

While that method offers protection, it's still putting too much trust in user-supplied data to get passed around. Looking up the entry is better since it eliminates the concern entirely.