@@ -283,14 +283,28 @@ <h1 data-i18n="wifi.restartPrompt"></h1>
 		}
 
 		function listWiFi(data) {
-			console.log(data);
 			var list = document.getElementById("WiFiList");
-			var h = "";
-			data.map(function (WiFis) {
-				h += `<div class="ssid" onclick="selectWiFi('${WiFis.ssid}')" title="${WiFis.quality}% (${WiFis.rssi} dBm) ${WiFis.bssid}"><span class="ico ${WiFis.wico}"></span><span class="name">${WiFis.ssid}</span><span class="ico ${WiFis.pico}"></span></div>\n`;
+			// Build the list via DOM nodes + textContent, never innerHTML: the SSID/BSSID are fully
+			// attacker-controlled (any nearby AP can broadcast a crafted 32-byte SSID), so string
+			// interpolation here would be DOM-based XSS on the page that takes the WiFi password.
+			list.textContent = "";
+			data.forEach(function (WiFis) {
+				var row = document.createElement("div");
+				row.className = "ssid";
+				row.title = WiFis.quality + "% (" + WiFis.rssi + " dBm) " + (WiFis.bssid || "");
+				row.addEventListener("click", function () { selectWiFi(WiFis.ssid); });
+				var wico = document.createElement("span");
+				wico.className = "ico " + WiFis.wico;
+				var name = document.createElement("span");
+				name.className = "name";
+				name.textContent = WiFis.ssid;
+				var pico = document.createElement("span");
+				pico.className = "ico " + WiFis.pico;
+				row.appendChild(wico);
+				row.appendChild(name);
+				row.appendChild(pico);
+				list.appendChild(row);
 			});
-			h += "<br>";
-			list.innerHTML = h;
 			setTimeout(getWiFiList, 5000);
 		}
 		// disable static input fields on toggle
 
@@ -210,9 +210,12 @@
 		"title": "Geräte-Passwort",
 		"password": {
 			"title": "Passwort",
-			"placeholder": "Leer lassen, um den Schutz zu deaktivieren",
-			"desc": "Ein gemeinsames Passwort für alles: Webinterface, FTP und WebDAV. Bei FTP und WebDAV ist der Benutzername egal – jeder Benutzername funktioniert, es zählt nur dieses Passwort. Nach dem Anmelden im Webinterface bleibt man 90 Tage eingeloggt; im Hotspot-Modus ist der Schutz inaktiv. Leer lassen, um den Schutz überall (Webinterface, FTP, WebDAV) zu deaktivieren.",
-			"show": "Passwort anzeigen/verbergen"
+			"placeholder": "Passwort festlegen",
+			"keep": "Leer lassen, um das aktuelle Passwort zu behalten",
+			"desc": "Ein gemeinsames Passwort für alles: Webinterface, FTP und WebDAV. Bei FTP und WebDAV ist der Benutzername egal – jeder Benutzername funktioniert, es zählt nur dieses Passwort. Nach dem Anmelden im Webinterface bleibt man 90 Tage eingeloggt; im Hotspot-Modus ist der Schutz inaktiv. Das Passwort wird nie wieder angezeigt; leer lassen, um es zu behalten. Zum Deaktivieren überall „Passwortschutz deaktivieren“ anhaken und speichern.",
+			"show": "Passwort anzeigen/verbergen",
+			"disable": "Passwortschutz deaktivieren",
+			"nochange": "Nichts zu speichern: neues Passwort eingeben oder „Passwortschutz deaktivieren“ anhaken."
 		},
 		"cookie": {
 			"title": "Anmeldung merken",
 
@@ -210,9 +210,12 @@
 		"title": "Device password",
 		"password": {
 			"title": "Password",
-			"placeholder": "Leave empty to disable protection",
-			"desc": "One shared password for everything: web interface, FTP and WebDAV. For FTP and WebDAV the username does not matter - any username works, only this password is checked. Once logged in to the web interface you stay logged in for 90 days; protection is inactive in hotspot mode. Leave empty to disable protection everywhere (web interface, FTP, WebDAV).",
-			"show": "Show/hide password"
+			"placeholder": "Set a password",
+			"keep": "Leave empty to keep the current password",
+			"desc": "One shared password for everything: web interface, FTP and WebDAV. For FTP and WebDAV the username does not matter - any username works, only this password is checked. Once logged in to the web interface you stay logged in for 90 days; protection is inactive in hotspot mode. The password is never shown again; leave the field empty to keep it. To turn protection off everywhere, tick “Disable password protection” and save.",
+			"show": "Show/hide password",
+			"disable": "Disable password protection",
+			"nochange": "Nothing to save: enter a new password or tick “Disable password protection”."
 		},
 		"cookie": {
 			"title": "Stay logged in",
 
@@ -203,9 +203,12 @@
 		"title": "Mot de passe de l'appareil",
 		"password": {
 			"title": "Mot de passe",
-			"placeholder": "Laisser vide pour désactiver la protection",
-			"desc": "Un seul mot de passe partagé pour tout : interface web, FTP et WebDAV. Pour le FTP et le WebDAV, le nom d'utilisateur n'a pas d'importance - n'importe quel nom fonctionne, seul ce mot de passe est vérifié. Une fois connecté à l'interface web, vous restez connecté pendant 90 jours ; la protection est inactive en mode hotspot. Laisser vide pour désactiver la protection partout (interface web, FTP, WebDAV).",
-			"show": "Afficher/masquer le mot de passe"
+			"placeholder": "Définir un mot de passe",
+			"keep": "Laisser vide pour conserver le mot de passe actuel",
+			"desc": "Un seul mot de passe partagé pour tout : interface web, FTP et WebDAV. Pour le FTP et le WebDAV, le nom d'utilisateur n'a pas d'importance - n'importe quel nom fonctionne, seul ce mot de passe est vérifié. Une fois connecté à l'interface web, vous restez connecté pendant 90 jours ; la protection est inactive en mode hotspot. Le mot de passe n'est jamais réaffiché ; laissez le champ vide pour le conserver. Pour tout désactiver, cochez « Désactiver la protection par mot de passe » puis enregistrez.",
+			"show": "Afficher/masquer le mot de passe",
+			"disable": "Désactiver la protection par mot de passe",
+			"nochange": "Rien à enregistrer : saisissez un nouveau mot de passe ou cochez « Désactiver la protection par mot de passe »."
 		},
 		"cookie": {
 			"title": "Rester connecté",
 
@@ -3421,6 +3421,10 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 								</div>
 								<small class="form-text" data-i18n="security.password.desc"></small>
 							</div>
+							<div class="form-check form-switch mb-3">
+								<input class="form-check-input" type="checkbox" id="securityDisable" name="securityDisable">
+								<label class="form-check-label" for="securityDisable" data-i18n="security.password.disable"></label>
+							</div>
 							<div class="text-center">
 								<button type="submit" class="btn btn-primary" data-i18n="submit"></button>
 							</div>
@@ -7506,9 +7510,12 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 			try {
 				const status = await apiGet("/security");
 				document.getElementById('menuLogout').setAttribute('data-visible', status.enabled === true);
-				if (status.password !== undefined) {
-					document.getElementById('wwwPassword').value = status.password;
-				}
+				// the password is write-only: the device no longer echoes it back, so the field stays
+				// empty (empty = keep current). Disabling protection is an explicit opt-in switch.
+				document.getElementById('wwwPassword').value = "";
+				document.getElementById('securityDisable').checked = false;
+				const pwPlaceholder = status.enabled === true ? 'security.password.keep' : 'security.password.placeholder';
+				document.getElementById('wwwPassword').setAttribute('placeholder', i18next.t(pwPlaceholder));
 				if (status.cookieDays !== undefined) {
 					const unlimited = (status.cookieDays === 0);
 					document.getElementById('cookieUnlimited').checked = unlimited;
@@ -7544,14 +7551,25 @@ <h5 class="modal-title" data-i18n="tools.nvs.erase.title"></h5>
 		}
 
 		async function securityConfig() {
+			const pw = document.getElementById('wwwPassword').value;
+			const disable = document.getElementById('securityDisable').checked;
+			const payload = {};
+			if (disable) {
+				// explicit opt-in: send an empty password to turn protection off everywhere
+				payload.password = "";
+			} else if (pw.length > 0) {
+				payload.password = pw;
+			} else {
+				// empty field + disable not ticked = nothing to change (don't accidentally clear it)
+				toaster.error(i18next.t('security.password.nochange'));
+				return;
+			}
 			const response = await fetch("http://" + host + "/security", {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json"
 				},
-				body: JSON.stringify({
-					password: document.getElementById('wwwPassword').value
-				})
+				body: JSON.stringify(payload)
 			});
 			if (response.ok) {
 				flashActionOk();
 
@@ -224,6 +224,43 @@ bool Web_DumpNvsToSd(const char *_namespace, const char *_destFile) {
 
 // First request will return 0 results unless you start scan from somewhere else (loop/setup)
 // Do not request more often than 3-5 seconds
+// Minimal JSON string escaper for the hand-concatenated JSON bodies in this file. SSIDs (and other
+// external strings) are attacker-controlled, so an unescaped quote/backslash/control char would
+// otherwise produce invalid JSON (client parse fails) or, in an innerHTML context, enable XSS.
+static String Web_JsonEscape(const String &in) {
+	String out;
+	out.reserve(in.length() + 8);
+	for (size_t i = 0; i < in.length(); i++) {
+		char c = in[i];
+		switch (c) {
+			case '"':
+				out += "\\\"";
+				break;
+			case '\\':
+				out += "\\\\";
+				break;
+			case '\n':
+				out += "\\n";
+				break;
+			case '\r':
+				out += "\\r";
+				break;
+			case '\t':
+				out += "\\t";
+				break;
+			default:
+				if ((uint8_t) c < 0x20) {
+					char u[7];
+					snprintf(u, sizeof(u), "\\u%04x", (uint8_t) c);
+					out += u;
+				} else {
+					out += c;
+				}
+		}
+	}
+	return out;
+}
+
 static void handleWiFiScanRequest(AsyncWebServerRequest *request) {
 	String json = "[";
 	int n = WiFi.scanComplete();
@@ -248,8 +285,8 @@ static void handleWiFiScanRequest(AsyncWebServerRequest *request) {
 				json += ",";
 			}
 			json += "{";
-			json += "\"ssid\":\"" + WiFi.SSID(i) + "\"";
-			json += ",\"bssid\":\"" + WiFi.BSSIDstr(i) + "\"";
+			json += "\"ssid\":\"" + Web_JsonEscape(WiFi.SSID(i)) + "\"";
+			json += ",\"bssid\":\"" + Web_JsonEscape(WiFi.BSSIDstr(i)) + "\"";
 			json += ",\"rssi\":" + String(WiFi.RSSI(i));
 			json += ",\"channel\":" + String(WiFi.channel(i));
 			json += ",\"secure\":" + String(WiFi.encryptionType(i));
@@ -395,6 +432,18 @@ static bool Web_IsAuthenticated(AsyncWebServerRequest *request) {
 	return token.equals(wwwSessionToken);
 }
 
+// Public auth gate for streaming body/upload handlers. The password middleware only wraps the
+// request *handler*; ESPAsyncWebServer invokes the upload/body callback while the body is still
+// streaming in, i.e. BEFORE the middleware chain runs. So /update (OTA), /upload (NVS restore)
+// and POST /explorer (SD write) must enforce auth themselves before touching flash/NVS/SD.
+// Mirrors the middleware: allowed in AP-mode or when no password is configured.
+bool Web_RequestAuthorized(AsyncWebServerRequest *request) {
+	if (WiFi.getMode() == WIFI_AP) {
+		return true;
+	}
+	return Web_IsAuthenticated(request);
+}
+
 static void Web_HandlePostLogin(AsyncWebServerRequest *request, JsonVariant &json) {
 	if (wwwLoginLockedUntil && (millis() < wwwLoginLockedUntil)) {
 		request->send(429);
@@ -530,9 +579,9 @@ void webserverStart(void) {
 			JsonDocument doc;
 			doc["enabled"] = (wwwSessionToken.length() > 0);
 			doc["cookieDays"] = gPrefsSettings.getUInt("wwwCookieDays", WWW_COOKIE_DAYS_DEFAULT);
-			// The whole management page already sits behind this very password (same as the FTP tab,
-			// which also returns its password), so the UI can show + reveal the current value.
-			doc["password"] = gPrefsSettings.getString("wwwPassword", "");
+			// The password is deliberately NOT returned: it is the shared web/FTP/WebDAV credential
+			// and echoing it back turns every authenticated read (or any XSS/CSRF that can fetch
+			// /security) into a plaintext credential leak. The field in the UI is write-only.
 			String out;
 			serializeJson(doc, out);
 			request->send(200, "application/json", out);
@@ -634,13 +683,24 @@ void webserverStart(void) {
 		// NVS-backup-upload
 		wServer.on(
 			"/upload", HTTP_POST, [](AsyncWebServerRequest *request) {
+				// the body handler (handleUpload) runs before the middleware, so re-check auth here
+				if (!Web_RequestAuthorized(request)) {
+					request->send(401);
+					return;
+				}
 				request->send(200);
 			},
 			handleUpload);
 
 		// OTA-upload
 		wServer.on(
 			"/update", HTTP_POST, [](AsyncWebServerRequest *request) {
+				// the upload handler streams (and flashes) the body before the middleware runs;
+				// guard the completion the same way the body handler guards the actual flash
+				if (!Web_RequestAuthorized(request)) {
+					request->send(401);
+					return;
+				}
 #ifdef BOARD_HAS_16MB_FLASH_AND_OTA_SUPPORT
 				if (Update.hasError()) {
 					request->send(500, "text/plain", Update.errorString());
@@ -656,6 +716,12 @@ void webserverStart(void) {
 				Log_Println(otaNotSupported, LOGLEVEL_NOTICE);
 				return;
 #endif
+				// CRITICAL: the middleware does NOT cover this streaming upload callback, so an
+				// unauthenticated client could otherwise flash arbitrary firmware. Refuse to touch
+				// Update unless the request is authorized (re-checked on every chunk).
+				if (!Web_RequestAuthorized(request)) {
+					return;
+				}
 
 				if (!index) {
 					// pause some tasks to get more free CPU time for the upload
@@ -973,6 +1039,11 @@ void webserverStart(void) {
 			"/explorer", HTTP_POST, [](AsyncWebServerRequest *request) {
 				// clean up buffers
 				request->onDisconnect([]() { destroyDoubleBuffer(); });
+				// the upload handler writes to SD before the middleware runs, so re-check auth here
+				if (!Web_RequestAuthorized(request)) {
+					request->send(401);
+					return;
+				}
 				// we are finished with the upload
 				if (!request->_tempObject) {
 					request->send(200);
 
@@ -118,6 +118,13 @@ void handleUploadError(AsyncWebServerRequest *request, int code) {
 // requires a GET parameter path, as directory path to the file
 void explorerHandleFileUpload(AsyncWebServerRequest *request, String filename, size_t index, uint8_t *data, size_t len, bool final) {
 
+	// This upload callback runs while the body streams in, before the password middleware. Refuse
+	// to write anything to SD for an unauthenticated client; the completion handler returns 401.
+	if (!Web_RequestAuthorized(request)) {
+		uploadAborted = true;
+		return;
+	}
+
 	System_UpdateActivityTimer();
 
 	// New File
@@ -698,6 +705,11 @@ void handleUpload(AsyncWebServerRequest *request, String filename, size_t index,
 	static File tmpFile;
 	static size_t fileIndex = 0;
 	static char tmpFileName[13];
+	// Runs before the password middleware (body streams in first), so an unauthenticated client
+	// could otherwise inject RFID assignments into NVS. Refuse to buffer or import anything.
+	if (!Web_RequestAuthorized(request)) {
+		return;
+	}
 	esp_task_wdt_reset();
 	if (!index) {
 		snprintf(tmpFileName, 13, "/_%lu", millis());
 
@@ -62,3 +62,8 @@ void Web_DumpSdToNvs(const char *_filename);
 
 // Aborts a running file-upload storage task and waits for it to exit (used by Web_Exit).
 void WebExplorer_AbortUpload(void);
+
+// Auth gate for streaming body/upload handlers (defined in Web.cpp). The password middleware
+// does not cover the upload callback, which runs while the body streams in, so handlers that
+// write flash/NVS/SD must call this themselves before doing anything.
+bool Web_RequestAuthorized(AsyncWebServerRequest *request);
@@ -231,6 +231,8 @@
 			if (p === "/activeSSID") { return jsonResp({ active: "Heimnetz" }); }
 			if (p === "/eqrules") { return jsonResp([]); }
 			if (p === "/homekit") { return jsonResp({ enabled: false, paired: false, code: "", deviceName: "ESPuino", tvName: "ESPuino TV" }); }
+			// password status: the device never echoes the password back (write-only field)
+			if (p === "/security") { return jsonResp({ enabled: false, cookieDays: 90 }); }
 			if (p === "/bluetoothresults") { return jsonResp([]); }
 			if (p === "/settings") {
 				var section = qs.get("section");
@@ -280,7 +282,7 @@
 		}
 
 		// Everything that writes / triggers an action on the device is a no-op in the demo.
-		if (/^\/(restart|shutdown|githubupdate|settings|sync|syncstop|rfidsync|backupupload|rfidnvserase|rfidresetpos|explorer|exploreraudio|homekit|bluetoothscan|bluetoothconnect|upload|savedSSIDs|trackcontrol|volume|ftp|webdav|logout)\b/.test(p)) {
+		if (/^\/(restart|shutdown|githubupdate|settings|sync|syncstop|rfidsync|backupupload|rfidnvserase|rfidresetpos|explorer|exploreraudio|homekit|security|bluetoothscan|bluetoothconnect|upload|savedSSIDs|trackcontrol|volume|ftp|webdav|logout)\b/.test(p)) {
 			return jsonResp({ status: "ok", demo: true });
 		}
 		return null;