diff options
| -rw-r--r-- | libs/web/luasrc/sauth.lua | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/libs/web/luasrc/sauth.lua b/libs/web/luasrc/sauth.lua index d25f287c5a..8182679ce7 100644 --- a/libs/web/luasrc/sauth.lua +++ b/libs/web/luasrc/sauth.lua @@ -45,14 +45,16 @@ end --- Prepare session storage by creating the session directory. function prepare() luci.fs.mkdir(sessionpath) - luci.fs.chmod(sessionpath, "a-rwx,u+rwx") + if not luci.fs.chmod(sessionpath, "a-rwx,u+rwx") then + error("Security Exception: Session path is not sane!") + end end --- Read a session and return its content. -- @param id Session identifier -- @return Session data function read(id) - if not id then + if not id or not sane() then return end clean() @@ -60,11 +62,18 @@ function read(id) end +--- Check whether Session environment is sane. +-- @return Boolean status +function sane() + return luci.fs.stat(sessionpath, "mode") == "rwx------" +end + + --- Write session data to a session file. -- @param id Session identifier -- @param data Session data function write(id, data) - if not luci.fs.stat(sessionpath) then + if not sane() then prepare() end luci.fs.writefile(sessionpath .. "/" .. id, data) |