diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2015-10-22 08:35:34 +0200 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2015-10-22 08:48:06 +0200 |
| commit | 94ab57f48c9a8704a0a7da87bfa6ced9e73ca9be (patch) | |
| tree | a4e362c10f884766fe0ba3b0aa3399d2ad191921 /modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm | |
| parent | d32c68503994d46aa71473a647118b431119ae2a (diff) | |
luci-mod-admin-full: restructure and fix backup, restore and sysuprade (#517)
Do not use standard post security checking for actions that require file upload
since reading the token value will trigger parsing of the http message body
before the file upload handler has been set, which causes LuCI to buffer the
entire request body in memory.
In order to simplify the code and logic flow, split action_flashops() into
separate handlers for reset, backup, restore and sysupgrade.
Let the backup restore and sysupgrade handlers use the new test_post_security()
method in luci.dispatcher to perform token checking *after* setting the upload
handler.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Diffstat (limited to 'modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm')
| -rw-r--r-- | modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm b/modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm index 1985058829..5ca0398e13 100644 --- a/modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm +++ b/modules/luci-mod-admin-full/luasrc/view/admin_system/upgrade.htm @@ -45,12 +45,11 @@ </fieldset> <div class="cbi-page-actions right"> - <form style="display:inline" action="<%=REQUEST_URI%>" method="post"> - <input class="cbi-button cbi-button-reset" type="submit" value="<%:Cancel%>" /> - </form> - <form style="display:inline" action="<%=REQUEST_URI%>" method="post"> + <form class="inline" action="<%=REQUEST_URI%>" method="post"> + <input type="hidden" name="token" value="<%=token%>" /> <input type="hidden" name="step" value="2" /> <input type="hidden" name="keep" value="<%=keep and "1" or ""%>" /> + <input class="cbi-button cbi-button-reset" name="cancel" type="submit" value="<%:Cancel%>" /> <input class="cbi-button cbi-button-apply" type="submit" value="<%:Proceed%>" /> </form> </div> |