Device Details: <select> dropdowns (devGroup, devLocation, devSite, etc.) fail to select current value when it contains HTML special characters like '&' #1853

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

In deviceDetails.php (deviceDetailsEdit.php), when a <select> field such as devGroup, devLocation, or devSite has a stored value in the Devices table that contains an HTML special character (most commonly &, e.g. devGroup = "Server & NAS" or "Smart Home & Media"), the dropdown in the Device Details tab fails to mark the matching <option> as selected and instead falls back to the first option (❌None / "").

Furthermore, if the user subsequently edits any other field on that device and clicks Save, setDeviceData() reads $("#NEWDEV_devGroup").val() (which is "") and silently overwrites the device's devGroup with "" in the database.

Root Cause:

1. In front/deviceDetailsEdit.php (line 336), fieldData is HTML-entity-encoded before being passed into generateFormHtml():

   // XSS prevention - encode special characters for string fields, but not for arrays (like children dynamic)
   fieldData = encodeSpecialChars(fieldData);

   For "Server & NAS", fieldData becomes "Server & NAS", which is passed as overrideValue -> inVal -> val -> valuesArray = ["Server & NAS"].
2. In front/js/db_methods.js (renderList) and front/js/settings_utils.js (generateOptions, lines 1014–1016), the available options for NEWDEV_devGroup are fetched via /dbquery/read (SELECT DISTINCT ... devGroup as id, devGroup as name FROM ...), which returns raw unencoded strings from SQLite (item.id = "Server & NAS").
3. generateOptions() then checks:

   let selected = options.length !== 0 && valuesArray.includes(item.id) ? 'selected' : '';
   optionsHtml += `<option class="${cssClass}" value="${encodeSpecialChars(item.id)}" ${selected}>${encodeSpecialChars(labelName)}</option>`;

   Because valuesArray contains "Server & NAS" (already encoded in deviceDetailsEdit.php:336) while item.id is "Server & NAS" (unencoded), valuesArray.includes(item.id) evaluates to false.

Note that generateFormHtml() / generateOptions() already encodes item.id and labelName via encodeSpecialChars() when rendering <option>, or for <input> fields in generateFormHtml() where val is interpolated. Alternatively, generateOptions() can compare valuesArray.includes(item.id) || valuesArray.includes(encodeSpecialChars(item.id)).

Expected Behavior

<select> dropdowns in deviceDetailsEdit.php (devGroup, devLocation, devSite, devType, etc.) should properly pre-select the device's current value even when the value contains & (e.g. "Server & NAS"), and saving the device should not wipe the field to "".

Steps To Reproduce

1. Assign a device a devGroup containing &, e.g. Server & NAS (via Multi-Edit, Workflows, or Device Details).
2. Reload deviceDetails.php?mac=<mac>.
3. Observe that the Group (NEWDEV_devGroup) dropdown displays ❌None instead of Server & NAS, even though Server & NAS is present in the dropdown options list and in the database (Devices.devGroup).
4. Click Save on the device -> devGroup is overwritten with "" (❌None).

Relevant app.conf settings

# Default NEWDEV_devGroup SQL options from server/plugins/newdev_template/config.json
NEWDEV_devGroup=""

docker-compose.yml

services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:26.10.0
    network_mode: host
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - NET_BIND_SERVICE

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

N/A (Pure frontend JavaScript issue in front/deviceDetailsEdit.php:336 and front/js/settings_utils.js:1014; backend /dbquery/read returns {"results":[{"id":"","name":"❌None"},{"id":"Server & NAS","name":"Server & NAS"}], "success":true})

Docker Logs

N/A (Frontend JS rendering issue in deviceDetailsEdit.php / settings_utils.js)