diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2018-04-09 07:04:38 +0200 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2018-04-09 07:19:28 +0200 |
| commit | b1b5723516a5ad11174c531c1c792dec5b753303 (patch) | |
| tree | 48064aa28aeee07b493c3ec3ca23e5480678fd6a /modules/luci-base | |
| parent | 0ab0303527cd8c006dc0e570e4385fc6e9c6ab40 (diff) | |
luci-base: consider empty parameters as well when testing POST requirement
The cbi class will react on an empty "cbi.submit" parameter as well so we
must intercept GET requests using that too.
Fixes 186e690c0 ("luci-base: dispatcher: reject non-POST requests with any cbi.submit value")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'modules/luci-base')
| -rw-r--r-- | modules/luci-base/luasrc/dispatcher.lua | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua index 486672757..91b86679f 100644 --- a/modules/luci-base/luasrc/dispatcher.lua +++ b/modules/luci-base/luasrc/dispatcher.lua @@ -136,8 +136,7 @@ local function require_post_security(target) if (type(required_val) == "string" and request_val ~= required_val) or - (required_val == true and - (request_val == nil or request_val == "")) + (required_val == true and request_val == nil) then return false end |