treewide: rework rollback/apply workflow

Rework the apply confirmation mechanism to be session agnostic in order to
circumvent cross domain restrictions which prevent the JS code from issuing
apply confirm requests in some cases, e.g. when changing the LAN IP.

Confirmation calls may now be done from unauthenticated pages, as long as a
matching confirmation token is sent along with the request.

The reasoning behind this is that there is little security impact in
confirming pending apply sessions, especially since those sessions can only
be initiated while being authenticated.

After this change, LuCI will now launch a confirmation process on every
rendered page when a rollback is pending. The confirmation will happen
regardless of whether the user is logged in or not, or if the current page
is a CBI form or static template.

A confirmation request now also requires a random one-time token which is
rendered along with the confirmation JavaScript code in order to succeed.

This token is not meant to provide security but to ensure that the confirm
was triggered from an interactive browser session and not some background
HTTP requests that happened to end up in the admin ui.

As a consequence, the different apply/confirm/rollback code paths in CBI
maps and the UCI change/revert pages have been consolidated into one common
implementation residing in the common global theme agnostic footer template.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

3 files changed, 31 insertions, 19 deletions

diff --git a/modules/luci-base/luasrc/view/cbi/apply_widget.htm b/modules/luci-base/luasrc/view/cbi/apply_widget.htm
index f76846ee8..4d7e9c56e 100644
--- a/modules/luci-base/luasrc/view/cbi/apply_widget.htm
+++ b/modules/luci-base/luasrc/view/cbi/apply_widget.htm
@@ -1,4 +1,4 @@
-<% export("cbi_apply_widget", function(redirect_ok) -%>
+<% export("cbi_apply_widget", function(redirect_ok, rollback_token) -%>
 <style type="text/css">
 	#cbi_apply_overlay {
 		position: absolute;
@@ -51,6 +51,7 @@
 	    uci_apply_holdoff = <%=math.max(luci.config and luci.config.apply and luci.config.apply.holdoff or 4, 1)%>,
 	    uci_apply_timeout = <%=math.max(luci.config and luci.config.apply and luci.config.apply.timeout or 5, 1)%>,
 	    uci_apply_display = <%=math.max(luci.config and luci.config.apply and luci.config.apply.display or 1.5, 1)%>,
+	    uci_confirm_auth = <% if rollback_token then %>{ token: '<%=rollback_token%>' }<% else %>null<% end %>,
 	    was_xhr_poll_running = false;
 
 	function uci_status_message(type, content) {
@@ -148,7 +149,7 @@
 
 			var delay = isNaN(duration) ? 0 : Math.max(1000 - duration, 0);
 			window.setTimeout(function() {
-				xhr.post('<%=url("admin/uci/confirm")%>', uci_apply_auth, call, uci_apply_timeout * 1000);
+				xhr.post('<%=url("admin/uci/confirm")%>', uci_confirm_auth, call, uci_apply_timeout * 1000);
 			}, delay);
 		};
 
@@ -177,8 +178,11 @@
 			'<img src="<%=resource%>/icons/loading.gif" alt="" style="vertical-align:middle" /> ' +
 			'<%:Starting configuration apply…%>');
 
-		xhr.post('<%=url("admin/uci")%>/' + (checked ? 'apply_rollback' : 'apply_unchecked'), uci_apply_auth, function(r) {
+		xhr.post('<%=url("admin/uci")%>/' + (checked ? 'apply_rollback' : 'apply_unchecked'), uci_apply_auth, function(r, tok) {
 			if (r.status === (checked ? 200 : 204)) {
+				if (checked && tok !== null && typeof(tok) === 'object' && typeof(tok.token) === 'string')
+					uci_confirm_auth = tok;
+
 				uci_confirm(checked, Date.now() + uci_apply_rollback * 1000);
 			}
 			else if (checked && r.status === 204) {
diff --git a/modules/luci-base/luasrc/view/cbi/map.htm b/modules/luci-base/luasrc/view/cbi/map.htm
index 83c3cb217..d65a16167 100644
--- a/modules/luci-base/luasrc/view/cbi/map.htm
+++ b/modules/luci-base/luasrc/view/cbi/map.htm
@@ -5,21 +5,6 @@
 <div class="cbi-map" id="cbi-<%=self.config%>">
 	<% if self.title and #self.title > 0 then %><h2 name="content"><%=self.title%></h2><% end %>
 	<% if self.description and #self.description > 0 then %><div class="cbi-map-descr"><%=self.description%></div><% end %>
-	<%- if firstmap and (applymap or confirmmap) then -%>
-		<%+cbi/apply_widget%>
-		<% cbi_apply_widget(redirect) %>
-		<div class="alert-message" id="cbi_apply_status" style="display:none"></div>
-		<script type="text/javascript">
-			document.addEventListener("DOMContentLoaded", function() {
-				<% if confirmmap then -%>
-					uci_confirm(true, Date.now() + <%=confirmmap%> * 1000);
-				<%- else -%>
-					uci_apply(true);
-				<%- end %>
-			});
-		</script>
-	<%- end -%>
-
 	<% if self.tabbed then %>
 		<ul class="cbi-tabmenu map">
 			<%- self.selected_tab = luci.http.formvalue("tab.m-" .. self.config) %>
diff --git a/modules/luci-base/luasrc/view/footer.htm b/modules/luci-base/luasrc/view/footer.htm
index f3574b6b1..d268d71cf 100644
--- a/modules/luci-base/luasrc/view/footer.htm
+++ b/modules/luci-base/luasrc/view/footer.htm
@@ -4,4 +4,27 @@
  Licensed to the public under the Apache License 2.0.
 -%>
 
-<% include("themes/" .. theme .. "/footer") %>
\ No newline at end of file
+<%
+	include("themes/" .. theme .. "/footer")
+
+	local is_rollback_pending, rollback_time_remaining, rollback_session, rollback_token = luci.model.uci:rollback_pending()
+
+	if is_rollback_pending or trigger_apply or trigger_revert then
+		include("cbi/apply_widget")
+		cbi_apply_widget(redirect, rollback_token)
+%>
+	<div class="alert-message" id="cbi_apply_status" style="display:none"></div>
+	<script type="text/javascript">
+		document.addEventListener("DOMContentLoaded", function() {
+			<% if trigger_apply then -%>
+				uci_apply(true);
+			<%- elseif trigger_revert then -%>
+				uci_revert();
+			<%- else -%>
+				uci_confirm(true, Date.now() + <%=rollback_time_remaining%> * 1000);
+			<%- end %>
+		});
+	</script>
+<%
+	end
+%>